Hot answers tagged

78

To defeat your enemy, you must know your enemy. What is spam? For our purposes, spam is any unsolicited bulk electronic message. Spam these days is intended to lure unsuspecting users into visiting a (usually shady) web site where they will be asked to buy products, or have malware delivered to their computers, or both. Some spam will deliver malware ...


33

Ok I managed to figure this out on my own, but I wanted to post the steps here for posterity because there was zero documentation on this (that I could find) and it was practically guess and check. After I set "Domain *" as described above, it would sign it like this: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=clientdomain.com; s=main; t=...


28

Once DKIM was setup (for help, see this guide) and verified successfully on my domain I still had to enable it in the AWS console at SES -> Domains -> DKIM Once that was done mails to Gmail no longer show up with the via bounces address. You can see it still shows as mailed by: amazonses.com when you view details of the sender but that's OK ...


25

I've managed over 100 separate mail environments over the years and have used numerous processes to reduce or help eliminate spam. Technology has evolved over time, so this answer will walk through some of the things I've tried in the past and detail the current state of affairs. A few thoughts about protection... You want to protect port 25 of your ...


21

Partly, I endorse what others have said; partly, I don't. Spamassassin This works very well for me, but you need to spend some time training the Bayesian filter with both ham and spam. Greylisting ewwhite may feel its day has come and gone, but I can't agree. One of my clients asked how effective my various filters were, so here are approximate stats ...


18

There should be no issues becoming a small mail provider. You seem to be doing the right things. Many large providers don't get things right, and hopefully get most of their mail delivered. If mail is being sent to the SPAM folder, it is likely you have missed something. There should be a record of why you have delivery issues: For bounced messages ...


16

To query the TXT record for DMARC, you can use: dig TXT _dmarc.example.org To query for a particular record for DKIM, you would need to know the selector prefix. You would then query it as TXT (for example with a google one): dig TXT google._domainkey.example.org


14

I am using a number of techniques which reduce spam to acceptable levels. Delay accepting connections from incorrectly configured servers. A majority of the Spam I receive is from Spambots running on malware infected system. Almost all of these do not pass rDNS validation. Delaying for 30 seconds or so before each response causes most Spambots to give ...


13

Along with verifying the domain and enabling DKIM on the domain, I also had to enable DKIM on the verified email address I was sending from.


11

You need to split them in the text field. I believe that 2048 is the practical limit for key sizes. Split the text field into parts 255 characters or less. There is overhead for each split. There are two formats for long fields. TXT "part one" \ "part two" TXT ( "part one" "part two" ) Both of which will combine as "part onepart two"...


10

I can't speak for you DKIM key, but your SPF record is set up wrong. You're specifying that the A record, MX record and PTR record are all permitted, and then the +all is saying that any address is valid. If you want to exclude other ip addresses then it needs to be a -all. You'll also want to declare the SPF record as a text record too, as not all mail ...


10

One thing missing in the above (excellent) replies is to set up outbound TLS. Gmail has started to punish senders not using TLS, and other providers aren't saying anything but I'm sure they will follow suit.


9

Inspired by Brian Armstrong's answer for dkim-filter here's how I did this for OpenDKIM. /etc/opendkim.conf Syslog yes UMask 002 KeyTable /etc/mail/dkim_key_table SigningTable refile:/etc/mail/dkim_signing_table Note that SigningTable has refile: in it's definition, this specifies that the file includes regular expressions; ...


8

Incorrect implementation leading to rejected mail is the only pitfall I can think of (or slow DNS propagation causing trouble: Make sure to publish your DNS record with the key a few days before you start sending DKIM-signed mail to avoid that). If your DomainKeys/DKIM setup is correct I don't think it can cause any problems since if the receiving end doesn'...


7

There are many reasons why a message might be flagged as spam. Having one domain send a message which is signed by a different domain should be more than enough to ensure it is flagged as spam. Quite simply, you need to get everything properly lined up. The signature needs to be the one for the sending domain, not the domain it is sending for. What you have ...


7

I have had similar few months ago. I would recommend you to send an email to check@isnotspam.com then you will get an email back containing all the results and scores. Then I think you will have a clear view of your the problem preventing your messages to get delivered to gmail inbox.


7

Your problem is that you're using an IPv6 address to send mail to google. In itself, that's not a problem except that: You didn't specific the IPv6 address of your MX in your SPF record, thus it will not work Google implements additional requirement for SMTP senders that uses IPv6: Additional guidelines for IPv6 The sending IP must have a PTR ...


6

They are two separate things. DomainKeys is older, created by Yahoo!. DKIM is DomainKeys + Identified Internet Mail (another scheme to verify emails created by Cisco). The headers are compatible, apparently, but some newer systems don't check DKIM, so you have to generate both to make everyone happy.


6

Your SPF record isn't affecting this. By the looks of it, you have a DMARC record set up, and you are not signing outgoing mail with DKIM. To remedy the problem, either sign the outgoing mail, or remove the DMARC policy. The DMARC record is a TXT record like the SPF record, but it is at _dmarc.example.net where example.net is your domain. If you don't ...


6

You can use that to generate a sample configuration, but should use openssl to generate your real keys. \\ Generate a private key openssl genrsa -out domainname.com.key 1024 \\ Generate a public key openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM After running those you'll have two files: # lc total 3 -rw-r--r-- 1 chris chris ...


5

No version of Exchange supports DKIM. Microsoft has put their support behind SPF/SenderID instead. There are a couple third-party products that can be added to Exchange to do DKIM (like this, for instance) but I personally wouldn't run that stuff on any of my Exchange servers. The more common approach is to have another server (or servers) sitting between ...


5

Looks like you may still have the wrong permissions on your keyfile. Chowning isn't enough, it must also be chmodded to 700. Here's a step-by-step walkthrough for setting up OpenDKIM on a CentOS box with Postfix: http://stevejenkins.com/blog/2010/09/how-to-get-dkim-domainkeys-identified-mail-working-on-centos-5-5-and-postfix-using-opendkim/ Follow those ...


5

There is virtually no way to do this within IIS 7.5 (or any version of IIS for that matter). There may be a way to hack it if you write your own module, however that's not so much an IIS hack as it is your own hack that plugs into IIS. There are third party tools that exist to perform this. For example, EA DomainKeys/DKIM for IIS SMTP Service and Exchange ...


5

The fact that an email is DKIM signed does not exclude the fact that its content is not considered as spam. DKIM is a method that validates the sender and that the content is actually sent by the sender, not that the content itself is not to be considered as spam by some other classification method.


5

When you use the SoftFail qualifier (the ~) in an SPF mechanism, you indicate that a matching sender should be treated with suspicion, but not outright rejected. The Fail qualifier (the -) on the other hand, encourages receiving MTAs to reject the SMTP transfer immediately with a 5.1.7 DSN. So when you are using ~all in the end of your record, you are ...


5

SPF has many more rankings than Pass/Fail. Using these in heuristically scoring spam makes the process easier and more accurate. Failing on account of "advanced setups" indicates the mail admin didn't know what he was doing in setting up the SPF record. There's no setup that SPF can't account for correctly. Cryptography doesn't work in absolutes, ever. The ...


5

Thanks to all who tried to help.. The issue was a bug with refile in opendkim when there is CR character in Signingtable file.. So, i saved the file in non DOS format to remove the CR character and it worked perfect...


5

E-Mail security sucks. So in the end, you're probably going to be faced with a decision where all your options are terrible, and break different things for different reasons. As for SPF specifically, a mailing list will cause a failure if it forwards a message, without rewriting the headers. A list can configure itself to work however it pleases, so there ...


5

You cannot compel others to filter their incoming mail based on SPF and DKIM, or indeed any other criteria at all. If google chooses to ignore SPF, so be it; you've done your bit, all you can do now is sit tight and ignore any complaints from people who don't filter on SPF. That said, having a valid SPF record does tend to reduce backscatter, because a ...


5

In your opendkim.conf file Mode v sets the operating mode to verify only, so your outgoing messages will never be signed. This is explained in the comment right above the relevant line: Selects operating modes. Valid modes are s (sign) and v (verify). Default is v. Must be changed to s (sign only) or sv (sign and verify) in order to sign outgoing ...



Only top voted, non community-wiki answers of a minimum length are eligible