5 ms·
> But SPF alone doesn’t completely solve spam, we also need DKIM, and to a lesser extent DMARC. More on those later! I recently wrote a short article on those,
by XCSme 6y ago
> But SPF alone doesn’t completely solve spam, we also need DKIM, and to a lesser extent DMARC. More on those later!
I recently wrote a short article on those, a tldr for setting up basic email authentication and anti-spam: https://www.usertrack.net/blog/stop-others-use-your-domain-emails https://www.usertrack.net/blog/stop-others-use-your-domain-e...
- deleted 6y ago[deleted]
- superkuh 6y agoWhat you describe, adding the DNS TXT record for DKIM, is just the icing on the cake. It's way more work and complex at postfix (+rspamd to sign or whatever) level. Suggesting that you can just, >Hostgator -> cPanel -> Email Authentication ...is ignoring 99% of the complexity and long term maintainance that DKIM implies. And why bother? It's not like the mega-corp walled gardens care if you have the perfect mailserver implementation. They'll mark you as spam or blacklist you anyway, because they can, because it's easier, because it's a job someone's doing for profit and you don't effect that. No. An SPF record is enough for determining if mail is legitimately from it's real mailserver. DKIM is cargo cult nonsense for most cases. A sacrifice to the google/microsoft/apple gods to hopefully earn their favor, but one that is almost always ignored anway.
- XCSme 6y agoI agree, mail deliverability is really hard. In my case, the mailserver is only used to use a custom email address and forward the email, so deliverability was not an issue but other people using my domain name to send phishing emails. By making the fixes mentioned in the article the phishing attacks were stopped.
- superasn 6y agoThat's a good writeup! Aren't DKIM and SPF supposedly doing the same thing of authenticating the email domain? If not, what's the difference?
- Volundr 6y agoIt's simplest terms, SPF allows you to prove (and equally importantly disprove) that a piece of mail comes from your domain based on IP address (there are a variety of mechanisms, but in the end it all boils down to IP). Basically SPF spells out specifically which hosts are allowed to send mail from your domain. DKIM allows you to prove a message originates from your domain via a cryptographic signature. So any mailserver with the private key can send messages from your domain, it's not limited to a predetermined subset. In different situations one can be more useful than the other. It's also recommended to implement both, as one or the other might fail for various reasons. It's also worth noting you really should implement DMARC as well, which lets you spell out a policy for what recipients should do if SPF and DMARC fail, including if they should notify you and how.
- Moru 6y agoJust please set up DMARC so it allows forwarding a mail... Have had this problem a number of times lately, companies sending mail to us that just vanish in thin air without any explanation. Turns out an alias adress is forwarding their mail to whoever is supposed to handle their mail at the moment and this is not allowed due to how they set up DMARC. The mail server just drops the mail without warning.
- beermonster 6y agoO2's billing emails, and a well known bank have broken DKIM signatures as they are improperly forwarded. No chance of getting through to their tech support, especially since these types of email are usually from a no-reply@ address and the people manning the phones are not the mail server admins anyway.
- yread 6y agotry emailing postmaster@
- beermonster 6y ago