3 ms·

Google seems to not agree DKIM is setup properly? https://toolbox.googleapps.com/apps/checkmx/check?domain=tablix.org https://toolbox.googleapps.com/apps/check

Google seems to not agree DKIM is setup properly? https://toolbox.googleapps.com/apps/checkmx/check?domain=tablix.org https://toolbox.googleapps.com/apps/checkmx/check?domain=tab...

proaralyst 7y ago
There's no standard DKIM selector though, right? You may have used a different DKIM selector in your query to the one they have set up
- LeonM 7y ago
  Google probably stores the selectors for a domain when it processes email from that domain.
supermatt 7y ago
Not set up to send email through google. Unless they are using gmail as an smtp relay (which they aren't), that shouldn't be a problem - otherwise he would be giving google authorisation to send emails on his behalf.
avian 7y ago
Thanks for the link. I think the tool you linked specifically checks whether DKIM is set to allow Google's servers to send mail on the behalf of your domain. These checkers for example don't find any errors with the DNS record: https://dmarcian.com/dkim-inspector/?domain=tablix.org&selector=alpha https://dmarcian.com/dkim-inspector/?domain=tablix.org&selec... https://mxtoolbox.com/SuperTool.aspx?action=dkim%3atablix.org%3aalpha&run=toolpage https://mxtoolbox.com/SuperTool.aspx?action=dkim%3atablix.or... One thing that this second one does find is the lack of a version number in the record. I see that the RFC [1] got updated since the last time I checked and having that is now recommended instead of optional. I'll add that. Thanks! EDIT: after adding version record, Google's tool now shows green checkmark for DKIM as well. In any case, it's impossible to test a DKIM setup just by looking at the DNS records. The true test is to verify the actual signature in the message. Last time I checked, the mail on the receiving end (Gmail), did have "dkim=pass" in the Authentication-Results headers. [1]: https://tools.ietf.org/html/rfc6376#section-3.6.1 https://tools.ietf.org/html/rfc6376#section-3.6.1
- tssva 7y ago
  You may also want to add a DMARC policy. A dmarc record generator can be found at https://mxtoolbox.com/DMARCRecordGenerator.aspx https://mxtoolbox.com/DMARCRecordGenerator.aspx

Google seems to not agree DKIM is setup properly? https://toolbox.googleapps.com/apps/checkmx/check?domain=tablix.org https://toolbox.googleapps.com/apps/checkmx/check?domain=tab...

proaralyst 7y ago

There's no standard DKIM selector though, right? You may have used a different DKIM selector in your query to the one they have set up

LeonM 7y ago
Google probably stores the selectors for a domain when it processes email from that domain.

supermatt 7y ago

Not set up to send email through google. Unless they are using gmail as an smtp relay (which they aren't), that shouldn't be a problem - otherwise he would be giving google authorisation to send emails on his behalf.

avian 7y ago

Thanks for the link. I think the tool you linked specifically checks whether DKIM is set to allow Google's servers to send mail on the behalf of your domain. These checkers for example don't find any errors with the DNS record: https://dmarcian.com/dkim-inspector/?domain=tablix.org&selector=alpha https://dmarcian.com/dkim-inspector/?domain=tablix.org&selec... https://mxtoolbox.com/SuperTool.aspx?action=dkim%3atablix.org%3aalpha&run=toolpage https://mxtoolbox.com/SuperTool.aspx?action=dkim%3atablix.or... One thing that this second one does find is the lack of a version number in the record. I see that the RFC [1] got updated since the last time I checked and having that is now recommended instead of optional. I'll add that. Thanks! EDIT: after adding version record, Google's tool now shows green checkmark for DKIM as well. In any case, it's impossible to test a DKIM setup just by looking at the DNS records. The true test is to verify the actual signature in the message. Last time I checked, the mail on the receiving end (Gmail), did have "dkim=pass" in the Authentication-Results headers. [1]: https://tools.ietf.org/html/rfc6376#section-3.6.1 https://tools.ietf.org/html/rfc6376#section-3.6.1

tssva 7y ago
You may also want to add a DMARC policy. A dmarc record generator can be found at https://mxtoolbox.com/DMARCRecordGenerator.aspx https://mxtoolbox.com/DMARCRecordGenerator.aspx