Sign in

Do I Need All Three Of SPF, DKIM And DMARC??

Solveddmarcdnsemailspf8 replies · 78 views · started
Reply
Accepted solution by Silas Nolan — you only get one SPF TXT record per name, so merge both senders into it: [code] use whatever include values each provider doucments. keep…
  1. Bram B.
    @voxelbuilder

    not gonna lie this is driving me nuts A few observations. say u have a domain that sends mail from two places: a hosted mailbox service and a web app using a transactional email API. deliverability is poor.

    Theres currently a basic SPF record and nothing else. Ive read enoguh to know that publishing a strict poilcy too early can make ur own invoices or password-reset emails disappear, which would be worse than teh current sitaution. Id also like to understand what each record actually does rather than copy values from a blog post.

    what's teh sensible order to roll out SPF, DKIM and DMARC without accidentally blocking your own mail? what am i doing wrong??

    cry

    4
  2. Nina O.
    @nokafor

    i might be wrong here, but @voxelbuilder do u have the full headers of one of teh spam-foldered messages? the Authentication-Results line shows exactly which checks pass or fail.

    0 6 helpful
  3. Bram B.
    @voxelbuilder
    in reply to @nokafor

    been there man headers show spf=pass but dkim=none and dmarc=fail for the contact-form mails.. lol the mailbox messages show spf=pass and no DMARC record found, so DKIM isnt set up anywhere yet. lmk how it goes

    3 4 helpful
  4. Silas Nolan
    @late_owl-2cx
    Accepted solution

    you only get one SPF TXT record per name, so merge both senders into it:

    v=spf1 include:_spf.mailhost.example include:send.transactional.example ~all

    use whatever include values each provider doucments. keep an eye on teh 10-DNS-lookup limit; each include counts, and nested includes count too.

    lol

    4 1 helpful
  5. Nina O.
    @emberdeck-2uk
    in reply to @late_owl-2cx

    yeahhh well... roll DMARC out in stages, start with monitoring only:

    _dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

    read the aggregate reports for a couple of weeks to find senders u forgot (invoicing tools, a newsletter service, the office scanner...). once everything lgeitimate passes, move to p=quarantine and eventually p=reject.

    1 0 helpful
  6. Ada Demir
    @ada_polar-322

    yeahhh from experience: DKIM is teh one that matters most these days. each sendnig service gives you a selector and a pbulic key (often as a CNAME pointing to their key)... enable it on both services. SPF alone breaks on forwarding; a valid DKIM signature usually survives it. lmk how it goes

    0 1 helpful
  7. Tariq B.
    @tariqb872

    ok so hi! one subtle point: DMARC needs alignment, not just a pass. the domain in the visible From: header must match the domain that passed SPF (teh envelope sender) or signed with DKIM.. xD transactional services often use their own boucne domain by defalut, so SPF passes for their domain and doesnt align... setting up a custom return-path or DKIM on your own domain fixes that.

    1 1 helpful
  8. Alba T.
    @alba.torres
    in reply to @tariqb872

    wait what i wouldn't sit on p=none forever, which is what a lot of ppl end up doing. it gives you reports but no protection against spoofing. set yourself a reminder to review the reports after a fixed period and actually move to quaarntine; otherwise the setup is only half done. just my 2 cents

    6 2 helpful
  9. Bram B.
    @voxelbuilder
    in reply to @late_owl-2cx

    dude finally got this sorted out, thanks to @late_owl-2cx for the heads up on teh SPF merge... i was way too close to making a mess by adding a second record which wouldve just broken everything. i consolidated both the mailbox and teh transactional API into a single record and kept it under teh lookup limit 😤

    also, @ada_polar-322 was spot on about the DKIM alignment... i spent a few hours fighting with teh transactional service using their default bounce domain, but once i switched to a custom return-path and added their DKIM keys, the DMARC status flipped from fail to pass... im still sitting on p=none for the reports like @Emberdeck-2uk suggested, but at least the mail is actually landing in inboxes now instead of the void... definitely a headache, but glad its done lol. seriously made my day 😭🙏

    party

    26 0 helpful

Reply to this topic

Sign in or create an account to reply.