Tag Info

New answers tagged

0

You can control what will happen in this case with a email standard called DMARC. It gives you the option to specify whether you require both or either of the checks to fail, before the message is marked as spam. Of course this have to be supported by the receiving mail server, but almost all of the major services and most of the MTA software supports it so ...


1

Your DMARC record should be under _dmarc.procrastination.com. This is a new specification and not widely supported. If you want reports you also need a TXT record containing v=DMARC1 at *._report._dmarc.procrastination.com or procrastination.com._report_dmarc.procrastination.com. You will know this is working when you start getting reports. Both Google ...


5

You cannot compel others to filter their incoming mail based on SPF and DKIM, or indeed any other criteria at all. If google chooses to ignore SPF, so be it; you've done your bit, all you can do now is sit tight and ignore any complaints from people who don't filter on SPF. That said, having a valid SPF record does tend to reduce backscatter, because a ...


5

Either v=spf1 a ~all and v=spf1 ip4:IP_OF_A_RECORD ~all would be suitable entries for a mail server. However the ~all negates most of the value of having an SPF record. Use of -all would be much better, and would be suitable for the entry for a mail server. With rare exceptions, no other server should be sending email on behalf of a mail server. The a ...


0

By reading your previous question thread, I gather that you are using exim. My suggestion then would be to configure it as a "send-only" MTA. I've personally used this guide to quickly configure send-only mail servers on public networks. Basically what it does is refuse external connections to the smtp port. I know it is not the most "standard" way of ...


7

It's not actually correct that the SPF RR type is the newer standard (in the context of desired SPF behavior). The experimental phase of the SPF specification had a new record type assigned but the migration path was unclear and it has since been abandoned. The current version of the SPF spec specifically states: SPF records MUST be published as a DNS ...


3

Yes, duplicate them; I don't know offhand what ratio of SPF checkers actually support the current standard for record type, but if I were to make a wild guess I'd wager that probably 10% of checkers won't look at an SPF record, only TXT.


3

SPF specifies that at most only 10 DNS resolutions should be made. So your SPF looks invalid. Remove extraneous portions - particularly that "include" - and test again. Many tools will give an SPF: pass (or SPF: none) when you have an invalid SPF record.


1

The behavior on SPF mismatch is entirely up to the receiving end, and considering how frequently SPF is configured incorrectly (or out of date) a lot of providers won't reject based on a mismatch (even with -all instead of ~all). It is common to see the spam score bumped because of a mismatch, and maybe even a match receiving a spam score decrease, but even ...



Top 50 recent answers are included