4 ms·
If you actually are looking for advice, then in descending importance order: * Enforce a DMARC policy instead of explicitly disabling it. * Enforce a strict S
by tambre 7y ago
If you actually are looking for advice, then in descending importance order:
* Enforce a DMARC policy instead of explicitly disabling it.
* Enforce a strict SPF policy instead of ~all.
* Send over IPv6. Usually stricter rules are applied and not-up-to-snuff emails are rejected at the SMTP level.
* Your provider hosts lots of spammers for their size. Consider switching.
* Enable MTA-STS.
The first two I'd consider obvious glaring mistakes. The next two are less important, but would help. MTA-STS is a nice-to-have.
I can't analyse your DKIM setup, since I don't know your selector. Feel free to send me a sample email if interested.
- Scramblejams 7y agoThanks for giving it a look! Enforcing DMARC and strict SPF tend to screw up mailing lists and forwarding. I don't see how I can enable them without causing a lot of other problems for me and my users. No arguments about my provider. Any tips on how to select a better one? I'm thinking someone who adds some friction to unblocking outbound port 25, e.g. Vultr, might be better.
- tambre 7y agoDMARC shouldn't be an issue for mailing lists, as long as one of DKIM/SPF passes. Are you seeing reports of both DKIM and SPF failing for mailing lists you use? Properly configured mailing lists shouldn't modify contents of emails causing DKIM to fail. I personally use Linode and would recommend them. But basically any tier 1/2 provider, i.e. too big/popular to block, will do. However, I would avoid DigitalOcean per my experience due to them completely blocking SMTP on IPv6 in addition to badly implemented IPv6 support and seemingly subpar support.
- deleted 7y ago[deleted]