4 ms·
Not exactly. SPF has many issues. One of which is that including external email providers will include large blocks of IP addresses to your SPF that you don't
by LeonM 5y ago
Not exactly.
SPF has many issues. One of which is that including external email providers will include large blocks of IP addresses to your SPF that you don't control. IP spoofing is also a thing. SPF also breaks horribly with forwarding email services (like catch-all inboxes). The SPF lookup limit of 10 additional lookups is way too low for most modern email setups.
SPF is just not very robust, and badly understood by most people (leading to many configuration mistakes). Hence that receivers cannot get much trust from the SPF outcome alone.
DKIM does send a "stronger signal" in the sense that it is more robust than SPF, and contains cryptographic proof. He who owns the private key is trusted by the domain (who published the public key) to send email on behalf of the domain. DKIM also does not suffer from the forwarding issue that SPF has.
As a result, a valid DKIM signature often does result in a higher trust rating by the receiver, than just an SPF pass.
DKIM + DMARC enforcement is the most reliable way to go. Obviously you still want to setup SPF as good as you can (until you start hitting size and lookup limits).
Disclaimer: I'm the founder of Mailhardener, an e-mail hardening platform.
- mercora 5y ago> IP spoofing is also a thing. IP spoofing is pretty hard to do with 2-way communication channels like TCP and a lot harder with TLS too. usually IP spoofing only works meaningfully with UDP and protocols that allow for transactions were you don't need replies from the target. to pull this of you would need to do BGP hijacking in order to receive return traffic which is a little above the efforts spammers will make.
- denton-scratch 5y ago> Not exactly. Are you saying that my core point is wrong, that SPF and DKIM serve orthogonal purposes, and that it's incorrect that one is somehow "more robust" than the other? I can't see what I said that you disagree with, except that somehow "DKIM and DMARC enforcement is the most reliable way to go". You've just said that you disagree, without providing much evidence. You need DKIM if you want deliverability to (principally) GMail. You need SPF if you don't want your mailserver blacklisted. You don't need DMARC, really, unless you send so many emails that you need some kind of automated reporting infrastructure.