Tag Info

Hot answers tagged

68

To defeat your enemy, you must know your enemy. What is spam? For our purposes, spam is any unsolicited bulk electronic message. Spam these days is intended to lure unsuspecting users into visiting a (usually shady) web site where they will be asked to buy products, or have malware delivered to their computers, or both. Some spam will deliver malware ...


27

Ok I managed to figure this out on my own, but I wanted to post the steps here for posterity because there was zero documentation on this (that I could find) and it was practically guess and check. After I set "Domain *" as described above, it would sign it like this: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=clientdomain.com; s=main; ...


23

I've managed over 100 separate mail environments over the years and have used numerous processes to reduce or help eliminate spam. Technology has evolved over time, so this answer will walk through some of the things I've tried in the past and detail the current state of affairs. A few thoughts about protection... You want to protect port 25 of your ...


21

Partly, I endorse what others have said; partly, I don't. Spamassassin This works very well for me, but you need to spend some time training the Bayesian filter with both ham and spam. Greylisting ewwhite may feel its day has come and gone, but I can't agree. One of my clients asked how effective my various filters were, so here are approximate stats ...


17

Once DKIM was setup (for help, see this guide) and verified successfully on my domain I still had to enable it in the AWS console at SES -> Domains -> DKIM Once that was done mails to Gmail no longer show up with the via bounces address. You can see it still shows as mailed by: amazonses.com when you view details of the sender but that's OK ...


14

I am using a number of techniques which reduce spam to acceptable levels. Delay accepting connections from incorrectly configured servers. A majority of the Spam I receive is from Spambots running on malware infected system. Almost all of these do not pass rDNS validation. Delaying for 30 seconds or so before each response causes most Spambots to give ...


10

I can't speak for you DKIM key, but your SPF record is set up wrong. You're specifying that the A record, MX record and PTR record are all permitted, and then the +all is saying that any address is valid. If you want to exclude other ip addresses then it needs to be a -all. You'll also want to declare the SPF record as a text record too, as not all mail ...


9

To query the TXT record for DMARC, you can use: dig TXT _dmarc.example.org To query for a particular record for DKIM, you would need to know the selector prefix. You would then query it as TXT (for example with a google one): dig TXT google._domainkey.example.org


8

Incorrect implementation leading to rejected mail is the only pitfall I can think of (or slow DNS propagation causing trouble: Make sure to publish your DNS record with the key a few days before you start sending DKIM-signed mail to avoid that). If your DomainKeys/DKIM setup is correct I don't think it can cause any problems since if the receiving end ...


8

Inspired by Brian Armstrong's answer for dkim-filter here's how I did this for OpenDKIM. /etc/opendkim.conf Syslog yes UMask 002 KeyTable /etc/mail/dkim_key_table SigningTable refile:/etc/mail/dkim_signing_table Note that SigningTable has refile: in it's definition, this specifies that the file includes regular expressions; ...


7

You need to split them in the text field. I believe that 2048 is the practical limit for key sizes. Split the text field into parts 255 characters or less. There is overhead for each split. There are two formats for long fields. TXT "part one" \ "part two" TXT ( "part one" "part two" ) Both of which will combine as "part onepart ...


7

There are many reasons why a message might be flagged as spam. Having one domain send a message which is signed by a different domain should be more than enough to ensure it is flagged as spam. Quite simply, you need to get everything properly lined up. The signature needs to be the one for the sending domain, not the domain it is sending for. What you have ...


7

I have had similar few months ago. I would recommend you to send an email to check@isnotspam.com then you will get an email back containing all the results and scores. Then I think you will have a clear view of your the problem preventing your messages to get delivered to gmail inbox.


7

Your problem is that you're using an IPv6 address to send mail to google. In itself, that's not a problem except that: You didn't specific the IPv6 address of your MX in your SPF record, thus it will not work Google implements additional requirement for SMTP senders that uses IPv6: Additional guidelines for IPv6 The sending IP must have a PTR ...


6

Your SPF record isn't affecting this. By the looks of it, you have a DMARC record set up, and you are not signing outgoing mail with DKIM. To remedy the problem, either sign the outgoing mail, or remove the DMARC policy. The DMARC record is a TXT record like the SPF record, but it is at _dmarc.example.net where example.net is your domain. If you don't ...


6

They are two separate things. DomainKeys is older, created by Yahoo!. DKIM is DomainKeys + Identified Internet Mail (another scheme to verify emails created by Cisco). The headers are compatible, apparently, but some newer systems don't check DKIM, so you have to generate both to make everyone happy.


5

No version of Exchange supports DKIM. Microsoft has put their support behind SPF/SenderID instead. There are a couple third-party products that can be added to Exchange to do DKIM (like this, for instance) but I personally wouldn't run that stuff on any of my Exchange servers. The more common approach is to have another server (or servers) sitting between ...


5

Looks like you may still have the wrong permissions on your keyfile. Chowning isn't enough, it must also be chmodded to 700. Here's a step-by-step walkthrough for setting up OpenDKIM on a CentOS box with Postfix: http://stevejenkins.com/blog/2010/09/how-to-get-dkim-domainkeys-identified-mail-working-on-centos-5-5-and-postfix-using-opendkim/ Follow those ...


5

There is virtually no way to do this within IIS 7.5 (or any version of IIS for that matter). There may be a way to hack it if you write your own module, however that's not so much an IIS hack as it is your own hack that plugs into IIS. There are third party tools that exist to perform this. For example, EA DomainKeys/DKIM for IIS SMTP Service and Exchange ...


5

The fact that an email is DKIM signed does not exclude the fact that its content is not considered as spam. DKIM is a method that validates the sender and that the content is actually sent by the sender, not that the content itself is not to be considered as spam by some other classification method.


5

SPF has many more rankings than Pass/Fail. Using these in heuristically scoring spam makes the process easier and more accurate. Failing on account of "advanced setups" indicates the mail admin didn't know what he was doing in setting up the SPF record. There's no setup that SPF can't account for correctly. Cryptography doesn't work in absolutes, ever. The ...


5

You cannot compel others to filter their incoming mail based on SPF and DKIM, or indeed any other criteria at all. If google chooses to ignore SPF, so be it; you've done your bit, all you can do now is sit tight and ignore any complaints from people who don't filter on SPF. That said, having a valid SPF record does tend to reduce backscatter, because a ...


4

Thanks to all who tried to help.. The issue was a bug with refile in opendkim when there is CR character in Signingtable file.. So, i saved the file in non DOS format to remove the CR character and it worked perfect...


4

You misspelled parameter non_smtpd_milters. Your config says non_smptd_milters not non_smtpd_milters. How I spot it: Googling for keyword non_smptd_milters would yield 5 results, but for keyword non_smtpd_milters would yield thousands result.


4

First of all, if you can, use a mass mailing service. There are plenty of them out there with various features and prices. Most don't cost very much. They will deal with things like managing people unsubscribing from lists, ensuring you are compliant with various anti spam legislation around the world, getting their servers off of blacklists, and give you ...


4

Although I'm still not sure why isn't $sender_address correctly populated, I found a workaround solution to my problem using another variable: DKIM_DOMAIN = ${lc:${domain:$h_from:}} This sets the domain name correctly on the DKIM signature. To stop signing domains I don't have a key for, I've set up two other macros: DKIM_FILE = ...


4

You are looking at the question from the wrong point of view - that of the sender. You should be looking it from the point of view of the receiver. So let's say we have a person@foo.com sending a message to us via mailserver random.com. We know nothing about either domain. Does a signature from foo.com on an email coming from person@foo.com tell you ...


4

You can use that to generate a sample configuration, but should use openssl to generate your real keys. \\ Generate a private key openssl genrsa -out domainname.com.key 1024 \\ Generate a public key openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM After running those you'll have two files: # lc total 3 -rw-r--r-- 1 chris chris ...


4

E-Mail security sucks. So in the end, you're probably going to be faced with a decision where all your options are terrible, and break different things for different reasons. As for SPF specifically, a mailing list will cause a failure if it forwards a message, without rewriting the headers. A list can configure itself to work however it pleases, so there ...


4

The SINGLE most effective solution I have seen is to use one of the external mail filtering services. I have experience with the following services at current clients. I am sure there are others. Each of these has done an excellent job in my experience. The cost is reasonable for all three. Postini from Google MXLogic from McAfee SecureTide from ...



Only top voted, non community-wiki answers of a minimum length are eligible