DomainKeys Identified Mail is a scheme for signing and verifying email messages to confirm that that the source hasn't been forged, and is typically implemented by MTAs. The source MTA adds a header to the message body containing a signature, and the destination MTA verifies this signature against a ...

learn more… | top users | synonyms

79
votes
6answers
40k views

Fighting Spam - What can I do as an: Email Administrator, Domain Owner, or User?

This is a Canonical Question about Fighting Spam. Also related: How to stop people from using my domain to send spam? What are SPF records, and how do I configure them? There are so ...
33
votes
5answers
580 views

Is it becoming impossible to be a small mail provider?

I operate a small mail server for my private emails, some friends who have websites and two NGOs. In total my server sends between 60 and 400 messages a day. Now a lot of these emails are personal ...
28
votes
4answers
16k views

DKIM sign outgoing mail from any domain (with Postfix and Ubuntu)

I got DKIM setup on my mail server (postfix and ubuntu) so it signs outgoing emails. I used these instructions: https://help.ubuntu.com/community/Postfix/DKIM However, I need it to sign emails from ...
17
votes
2answers
12k views

Remove “via” from emails sent to Gmail from Amazon SES

When sending emails from Amazon SES, gmail shows "sent via amazonses.com". How do I remove this? According to Google, I'm a sender and I don't want my recipients to see the "via" link. What can I ...
11
votes
3answers
7k views

Find DKIM and DMARC Records?

Is there a method to find a domain's DKIM and DMARC records using dig or nslookup? I have attempted to do the following: dig somedomain.org any returns many records, but not the known DKIM and ...
10
votes
1answer
652 views

Are there any pitfalls to DKIM?

We are considering implementing DKIM, the pros seem pretty obvious. Are there any cons? I know this is a bit vague and possibly subjective so I will accept what seems to me to be the most complete ...
10
votes
2answers
3k views

How did spammer spoof emails with my google apps domain (it even has DKIM!)

I have been getting a lot of bounce-backs lately. I thought my google apps account has been compromised, but there is no activity on my apps account, and there is certainly no malicious user that I ...
8
votes
1answer
667 views

Exim 4.71 does not add DKIM signature to outgoing emails

I am trying to add DKIM to my domain, I have created a key, added the following to /etc/exim4/conf.d/transport/30_exim4_config_remote_smtp: dkim_domain = mydomain.com dkim_selector = mail1 ...
7
votes
4answers
2k views

Why does my mail get marked as spam?

I Have the server "afspraakmanager.be". It matches everything not to be a spam server.(it isn't by the way): it has reverse dns, spf,dkim,... . But hotmail marks it as spam. I think the problem is ...
7
votes
2answers
12k views

How do I enter a strong (long) DKIM key into DNS?

I'm trying to enter a 4028 bit DKIM key into DNS and it seems that I'm exceeding both the UDP 512 byte limit and also the maximum record size for a TXT record. How does someone properly create a ...
7
votes
4answers
9k views

Getting Exchange to do DKIM

Having read Jeff's blog post about Email and DKIM, I'm thinking it might be good to DKIM all mail coming out of our Exchange 2003 servers. Whats a good way of going about that?
6
votes
3answers
8k views

Why is my email failing Gmail's DKIM test?

I have a message that was rejected by Gmail, I don't know why. It passes SPF. We aren't using DKIM. Do I need to set up DKIM? I am in control of "example.com". Our mail server is "server.example.com" ...
6
votes
3answers
1k views

DKIM vs Domain Keys

I've configured DKIM (milter-dkim) on my mail server. Incoming e-mail sent from my domain now containts the following header: X-DKIM: Sendmail DKIM Filter v2.8.3 MYDOMAIN.com o7FLH1Wa032083 DKIM-...
6
votes
2answers
2k views

SPF vs. DKIM - The exact use cases and differences

I'm sorry for the vague title. I don't fully understand why SPF and DKIM should be used together. First: SPF can pass where it should fail if the sender or DNS is "spoofed" and it can fail where it ...
6
votes
1answer
3k views

Exim doesn't want to do DKIM signing correctly

I'm using exim 4.82 on Debian sid. I've followed several tutorials on how to configure exim to sign outgoing emails, but it seems like something is not behaving as it should be. My diagnosis is that $...
6
votes
1answer
6k views

DKIM and SPF for a subdomain

I manage a VPS on Linode accessed through subdomain.example.com and I need to send email from this subdomain. I can't set any TXT records in Linode DNS manager because the name servers for example.com ...
6
votes
3answers
6k views

Setting up DKIM for multiple domains on same host

I have DKIM set up for one domain and it works properly. I am trying, though, to set it up for another domain name on the same machine. In short, I am sending registration and password recovery emails ...
6
votes
2answers
429 views

Designating A DKIM Signer Other Than The “From” Domain

A few months ago, I implemented SPF/DKIM/DMARC for my three-person company. After a trial period, I switched our DMARC to "p=reject", so that emails are rejected if they fail SPF/DKIM. Generally, it ...
5
votes
3answers
3k views

PTR OK, SPF, DKIM passed but email messages are marked as Spam by Google?

# host 1.2.3.4 4.3.2.1.in-addr.arpa domain name pointer mail.domain.vn. # dig +short txt domain.vn "v=spf1 a mx ptr -all" # dig +short txt mail.domain.vn "v=spf1 a -all" Here's an email header ...
5
votes
4answers
9k views

What exactly is a X-YMailISG header?

Finally ... our emails are being seen by Yahoo! not as junk anymore. Hurray! However I notice that the Yahoo! receiving MTA adds in a X-YMailISG header. It's very large ... 2**10 bits? Now that I'...
5
votes
2answers
3k views

SPF hardfail and DKIM failure when recipient has e-mail forwarding

I configured hardfail SPF for my domain and DKIM message signing on my SMTP server. Since this is the only SMTP server that should be used for outgoing mail from my domain, I didn't foresee any ...
5
votes
2answers
2k views

What are the advantages of DKIM?

After making my server sign outgoing email I started to wonder what the benefits are. This is the opposite of a previously asked question. Naively I see two benefits: We can throw away all emails ...
4
votes
3answers
522 views

Will mailing lists “break” if SPF is too restrictive?

I have recently configured my own mail server (Linux-based postfix + dovecot scenario). This is just for personal use - I have no bulk mail going out, no automatically generated mail outbound from the ...
4
votes
1answer
1k views

DKIM not signing with alias addresses - not internal, not authenticated

I have postfix, dovecot, opendkim and postsrsd installed. I am trying to forward mail from alias@example.com to myemail@gmail.com, and have them signed with DKIM. I use postsrsd in order for the SPF ...
4
votes
1answer
606 views

What problems can an ADSP record in DNS cause for mailflow?

ADSP is an entry in DNS that works allows a domain owner to assert that all email must be signed with DKIM. (similar to the -all and ~all in SPF/SenderID). Messages that fail ADSP policy may be ...
4
votes
1answer
11k views

Yahoo Domain Keys setup, getting dkim=permerror (no key)

I'm working on getting DKIM installed on my outgoing mail server, to help my email deliverability to my Yahoo clients (all legit emails, etc, no spamming). I've got DKIM-Signature: and DomainKey-...
4
votes
1answer
2k views

DKIM body hash fail

We're sending out e-mails with EXIM 4.71 from a PHP application. DKIM is enabled and is working properly, unless when sending a specific type of mails, which results in dkim=neutral (body hash did not ...
4
votes
2answers
2k views

Postfix with DKIM on Ubuntu

I want to improve deliverability for my outgoing emails with DKIM. I've gotten dkim-filter installed for postfix, using this tutorial https://help.ubuntu.com/community/Postfix/DKIM It seems to be ...
4
votes
1answer
5k views

postfix + opendkim not signing correctly. how to debug this?

EDIT: I did get a little further but all posts on my search say permissions are wrong or regenerate key but I fixed that to be 644 as well as owned by DKIM AND I keep regenerating the key but it is ...
4
votes
1answer
341 views

Does DKIM works with subdomains?

ISP's recommend you segment your marketing and transactional emails by using different IPs. I want to start using DKIM, but since DKIM is a domain based reputation system I wonder if signing with the ...
4
votes
3answers
7k views

Domain Key not showing up in DNS query

*SOLVED - See bottom of this post * So problem here is that I have been trying to set up a domain key for several days. I've done it successfully in the past, but I just can't get it to work this ...
3
votes
3answers
8k views

no signing table match in OpenDKIM

I have OpenDKIM installed on CentOS. I am using postfix as MTA and dovecot for IMAP/POP3. Now the problem is am trying to setup DKIM for my domain. The mails are send from a sub domain mail.example....
3
votes
2answers
300 views

Why do I need to escape ; with \ in a DNS DKIM record?

I'm setting up Email Authentication on our domain to allow authentication with our Email Service Provider. My understanding is that the DNS record needs to have any ; escaped, e.g., \; I just want ...
3
votes
1answer
1k views

OpenDKIM milter with Postfix

I just configured opendkim and postfix and it is supossed to be signing my emails but it doesn't. I used /usr/sbin/opendkim-testkey to test the keys and it seems to be ok with them but the mails I ...
3
votes
1answer
3k views

How to add DKIM feature to the IIS 7.5 - Windows Server 2008 - DomainKeys Identified Mail

How to add DKIM feature to the IIS 7.5 - Windows Server 2008 DomainKeys Identified Mail
3
votes
1answer
22 views

When implementing DKIM, should I publish DNS first or start signing first?

I am about to implement DKIM signing on my domain, but couldn't find information about which one to start first: publish DNS or start signing keys. Explains better: Considering the time DNS takes to ...
3
votes
1answer
6k views

How do I use OpenDKIM with multiple domain names on a single server?

How do I use OpenDKIM with multiple domain names on a single server? I own 3 domain names, and I have a single server that's running postfix for sending email. How do I use OpenDKIM? Can I use the ...
3
votes
1answer
170 views

correct order for Postfix milters

I use the following milters with Postfix: ClamAV, OpenDKIM, OpenDMARC, Rspamd This is also the order they are being called via smtpd_milters. What would be the best order for them regarding ...
3
votes
2answers
274 views

Migrating Email Providers; Are Multiple DKIM Records Viable During Transition?

I am currently gathering requirements for a small (hopefully) project of migrating from SendGrid to Mandrill as a transactional email service provider. We have been using SendGrid for close to 3-4 ...
3
votes
3answers
338 views

Is there anything bad about DKIM-signing mail without the key in DNS?

At a site that I manage, we send out emails for many customer domains. Some of them have our DKIM key in DNS, some don't. From what I can tell: Signature verification failure does not force ...
3
votes
2answers
202 views

Receiving DMARC reports for emails I do not send

I am hosting the email for my domain (lets call it example.com) on google apps (free legacy edition). I recently enabled the DMARC reports so I now get a daily report for the emails sent from my ...
3
votes
1answer
92 views

What is the benefit of using DKIM to sign Content Type?

DKIM has the ability to sign headers on a per-header basis. I looked at Google's headers, and they DKIM sign ContentType. What is the security benefit of signing ContentType?
3
votes
2answers
381 views

Should DKIM selector names be unguessable?

The M³WAAG DKIM Key Rotation Best Practices document (pdf) recommends a "sufficiently" random DKIM selector name so that it cannot be guessed by browsing the DNS. A literal quotation: 4.3 Key ...
2
votes
3answers
928 views

Wildcard configured emails allow spammers to deliver mail? (SPF: “softfail”)

I have a Google Apps account set up for one of my domains. Wildcard email delivery is enabled on this domain for all emails (ie. anything@domain.com passes emails along to myemail@domain.com), and the ...
2
votes
3answers
422 views

Is it safe to use port25 to generate DKIM key

I found this site. But if I use it, doesn't it mean that port25.com would know and be able to use my private key?
2
votes
2answers
2k views

What is the correct mail set up for multiple domains on one server?

I have a machine (centos 5) with one external ip address. On that machine I have many virtual hosts with a few different top level domain names and sub-domains under those eg. sub1.domain1.com sub2....
2
votes
1answer
146 views

DKIM: Can I use a RSA key larger than 2048bit, i.e. 4096?

I wonder if I can simply use a 4096bit RSA key for DKIM (in DNS TXT Record). Are there any downsides (neglecting computational effort)? Maybe there are mail servers which can't handle a key this large?...
2
votes
2answers
345 views

Only enable SRS when forwarding to enable DMARC

I am setting up a mail server on my VPS and in order to prevent spam and being marked as spam I have enabled SPF, DKIM and DMARC. However, I do not want to host my own mailbox, so I forward the ...
2
votes
2answers
418 views

Mail with DKIM Signature gets T_DKIM_INVALID flag by SpamAssassin

I've installed a Debian (jessie) box with postfix and spamassassin. Configured and everything works fine. Except receiving mails with DKIM signatur will produce a flag T_DKIM_INVALID even if the ...
2
votes
3answers
3k views

Should I reject email on SPF and/or DKIM failures? [duplicate]

I’m administering a mail server (cPanel/WHM) running Exim. It handles normally a few hundreds incoming emails per day for our customers. I’m not sure if I should reject SPF and/or DKIM failures for ...