Tag Info

Hot answers tagged

53

To defeat your enemy, you must know your enemy. What is spam? For our purposes, spam is any unsolicited bulk electronic message. Spam these days is intended to lure unsuspecting users into visiting a (usually shady) web site where they will be asked to buy products, or have malware delivered to their computers, or both. Some spam will deliver malware ...


26

Ok I managed to figure this out on my own, but I wanted to post the steps here for posterity because there was zero documentation on this (that I could find) and it was practically guess and check. After I set "Domain *" as described above, it would sign it like this: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=clientdomain.com; s=main; ...


20

I've managed over 100 separate mail environments over the years and have used numerous processes to reduce or help eliminate spam. Technology has evolved over time, so this answer will walk through some of the things I've tried in the past and detail the current state of affairs. A few thoughts about protection... You want to protect port 25 of your ...


17

Partly, I endorse what others have said; partly, I don't. Spamassassin This works very well for me, but you need to spend some time training the Bayesian filter with both ham and spam. Greylisting ewwhite may feel its day has come and gone, but I can't agree. One of my clients asked how effective my various filters were, so here are approximate stats ...


14

I am using a number of techniques which reduce spam to acceptable levels. Delay accepting connections from incorrectly configured servers. A majority of the Spam I receive is from Spambots running on malware infected system. Almost all of these do not pass rDNS validation. Delaying for 30 seconds or so before each response causes most Spambots to give ...


9

I can't speak for you DKIM key, but your SPF record is set up wrong. You're specifying that the A record, MX record and PTR record are all permitted, and then the +all is saying that any address is valid. If you want to exclude other ip addresses then it needs to be a -all. You'll also want to declare the SPF record as a text record too, as not all mail ...


8

Incorrect implementation leading to rejected mail is the only pitfall I can think of (or slow DNS propagation causing trouble: Make sure to publish your DNS record with the key a few days before you start sending DKIM-signed mail to avoid that). If your DomainKeys/DKIM setup is correct I don't think it can cause any problems since if the receiving end ...


8

Once DKIM was setup (for help, see this guide) and verified successfully on my domain I still had to enable it in the AWS console at SES -> Domains -> DKIM Once that was done mails to Gmail no longer show up with the via bounces address. You can see it still shows as mailed by: amazonses.com when you view details of the sender but that's OK ...


7

There are many reasons why a message might be flagged as spam. Having one domain send a message which is signed by a different domain should be more than enough to ensure it is flagged as spam. Quite simply, you need to get everything properly lined up. The signature needs to be the one for the sending domain, not the domain it is sending for. What you have ...


7

Your problem is that you're using an IPv6 address to send mail to google. In itself, that's not a problem except that: You didn't specific the IPv6 address of your MX in your SPF record, thus it will not work Google implements additional requirement for SMTP senders that uses IPv6: Additional guidelines for IPv6 The sending IP must have a PTR ...


6

Inspired by Brian Armstrong's answer for dkim-filter here's how I did this for OpenDKIM. /etc/opendkim.conf Syslog yes UMask 002 KeyTable /etc/mail/dkim_key_table SigningTable refile:/etc/mail/dkim_signing_table Note that SigningTable has refile: in it's definition, this specifies that the file includes regular expressions; ...


6

You need to split them in the text field. I believe that 2048 is the practical limit for key sizes. Split the text field into parts 255 characters or less. There is overhead for each split. There are two formats for long fields. TXT "part one" \ "part two" TXT ( "part one" "part two" ) Both of which will combine as "part onepart ...


6

I have had similar few months ago. I would recommend you to send an email to check@isnotspam.com then you will get an email back containing all the results and scores. Then I think you will have a clear view of your the problem preventing your messages to get delivered to gmail inbox.


5

No version of Exchange supports DKIM. Microsoft has put their support behind SPF/SenderID instead. There are a couple third-party products that can be added to Exchange to do DKIM (like this, for instance) but I personally wouldn't run that stuff on any of my Exchange servers. The more common approach is to have another server (or servers) sitting between ...


5

Looks like you may still have the wrong permissions on your keyfile. Chowning isn't enough, it must also be chmodded to 700. Here's a step-by-step walkthrough for setting up OpenDKIM on a CentOS box with Postfix: http://stevejenkins.com/blog/2010/09/how-to-get-dkim-domainkeys-identified-mail-working-on-centos-5-5-and-postfix-using-opendkim/ Follow those ...


5

The fact that an email is DKIM signed does not exclude the fact that its content is not considered as spam. DKIM is a method that validates the sender and that the content is actually sent by the sender, not that the content itself is not to be considered as spam by some other classification method.


5

SPF has many more rankings than Pass/Fail. Using these in heuristically scoring spam makes the process easier and more accurate. Failing on account of "advanced setups" indicates the mail admin didn't know what he was doing in setting up the SPF record. There's no setup that SPF can't account for correctly. Cryptography doesn't work in absolutes, ever. The ...


5

To query the TXT record for DMARC, you can use: dig TXT _dmarc.example.org To query for a particular record for DKIM, you would need to know the selector prefix. You would then query it as TXT (for example with a google one): dig TXT google._domainkey.example.org


4

They are two separate things. DomainKeys is older, created by Yahoo!. DKIM is DomainKeys + Identified Internet Mail (another scheme to verify emails created by Cisco). The headers are compatible, apparently, but some newer systems don't check DKIM, so you have to generate both to make everyone happy.


4

There is virtually no way to do this within IIS 7.5 (or any version of IIS for that matter). There may be a way to hack it if you write your own module, however that's not so much an IIS hack as it is your own hack that plugs into IIS. There are third party tools that exist to perform this. For example, EA DomainKeys/DKIM for IIS SMTP Service and Exchange ...


4

Because gmail has a different (and generally regarded as "better") spam filter than Yahoo! does. Different spam filters behave differently. Gmail also has guidelines and a help page for bulk senders, which will probably be much more helpful to you than us, so I recommend you check it out.


4

When you use the SoftFail qualifier (the ~) in an SPF mechanism, you indicate that a matching sender should be treated with suspicion, but not outright rejected. The Fail qualifier (the -) on the other hand, encourages receiving MTAs to reject the SMTP transfer immediately with a 5.1.7 DSN. So when you are using ~all in the end of your record, you are ...


4

Your SPF record isn't affecting this. By the looks of it, you have a DMARC record set up, and you are not signing outgoing mail with DKIM. To remedy the problem, either sign the outgoing mail, or remove the DMARC policy. The DMARC record is a TXT record like the SPF record, but it is at _dmarc.example.net where example.net is your domain. If you don't ...


4

You can use that to generate a sample configuration, but should use openssl to generate your real keys. \\ Generate a private key openssl genrsa -out domainname.com.key 1024 \\ Generate a public key openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM After running those you'll have two files: # lc total 3 -rw-r--r-- 1 chris chris ...


4

E-Mail security sucks. So in the end, you're probably going to be faced with a decision where all your options are terrible, and break different things for different reasons. As for SPF specifically, a mailing list will cause a failure if it forwards a message, without rewriting the headers. A list can configure itself to work however it pleases, so there ...


4

First of all, if you can, use a mass mailing service. There are plenty of them out there with various features and prices. Most don't cost very much. They will deal with things like managing people unsubscribing from lists, ensuring you are compliant with various anti spam legislation around the world, getting their servers off of blacklists, and give you ...


3

Take a look at this person's question and answer: DKIM sign outgoing mail from any domain with postfix and ubuntu http://serverfault.com/questions/52830/dkim-sign-outgoing-mail-from-any-domain-with-postfix-and-ubuntu You may also need to read this (especially if you're on Ubuntu) https://help.ubuntu.com/community/Postfix/DKIM You'll still need to poke ...


3

The forwarding server needs to setup SRS in order not to break your SPF http://www.openspf.org/SRS


3

You'll need to set up a KeyTable with a separate line for each selector/domain/keyfile. It would look like this: default._domainkey.example1.com example1.com:default:/etc/mail/dkim/keys/example1.com/default default._domainkey.example2.com example2.com:default:/etc/mail/dkim/keys/example2.com/default default._domainkey.example3.com ...


3

Look in you other question! If you don't know about DKIM then learn about DKIM. DKIM is a public-key signing procedure. You sign all your mail with the private key (key01) and then let others verify your signature with the public key published in DNS. But you have to sign your mails. Otherwise there is no way to verify something! And please DO NOT use ...



Only top voted, non community-wiki answers of a minimum length are eligible