19

I need to setup SPK and DKIM record for mail.mydomain.com. I have set the following at namecheap -

For SPF -

Record type :TXT

Hostname : mail.mydomain.com

Value : v=spf1 ip4:x.x.x.x ~all

For DKIM -

Record type : TXT

Host : mailer._domainkey

Value : "v=DKIM1; k=rsa; p=LONGSTRING"

This does not work when checked with online checking tools like mail-tester, mxtoolbox etc.

[SOLVED]

Unlike one of the answers below, it is possible to setup records for subdomains as well. It is an issue with Namecheap (and likely other providers as well). You need to setup hostname like this-

SPF hostname : mail
DKIM hostname : mailer._domainkey.mail

Namecheap will automatically add the domain.com at the end. You don't need to add it. Also DNS propagation for DKIM records took over 15 hours.

Improve this question
2
  • Unless you are signing email for users with as mailer._domainkey.mail, the DKIM key will not be found. Assuming your users are sending mail with addresses llike [email protected], you should be signing for mydomain.com, in which case your DKIM record will not be found
    – BillThor
    May 22, 2017 at 1:08
  • 2
    if you solved it, you should probably answer and accept your own question instead of editing
    – istepaniuk
    Aug 6, 2019 at 16:28

2 Answers 2

Reset to default
21

Like in the answer from BillThor, you probably NEED to set up SPF and DKIM for the example.com i.e. the hostname used in email addresses [email protected], whereas mail.example.com is only a MX for the domain. But, to answer the exact question...

Unlike claimed on another answer, it is possible to set up both SPF and DKIM on every level. After all, example.com. is a subdomain of com. that is also a subdomain of ., not to even mention domains that are already next level subdomains, e.g. co.uk.

  • SPF records are defined (RFC 7208, 3) to be placed in the DNS tree at the owner name it pertains to, not in a subdomain under the owner name. The first line is for mail sent from [email protected] and the second for [email protected].

    example.com.       IN   TXT   "v=spf1 a mx -all"
mail.example.com.  IN   TXT   "v=spf1 a mx -all"

    SPF is not inherited i.e. it doesn't protect subdomains. Additionally, for every subdomain with an A record that isn't intended for sending email you should add:

    sub.example.com.   IN   TXT   "v=spf1 -all"

  • DKIM recods are defined differently: DKIM Namespace (RFC 6376, 3.6.2.1) is a subdomain:

    All DKIM keys are stored in a subdomain named _domainkey. Given a DKIM-Signature field with a d= tag of example.com and an s= tag of foo.bar, the DNS query will be for foo.bar._domainkey.example.com.

    In the DKIM-Signature email header you can have d=example.com or d=mail.example.com, with the corresponding [email protected] / [email protected]. Equivalent DNS records:

    selector._domainkey.example.com.        IN   TXT   "v=DKIM1; k=rsa; p=...
selector._domainkey.mail.example.com.   IN   TXT   "v=DKIM1; k=rsa; p=...

  • Once you have implemented (and tested) SPF and DKIM, consider protecting the From header by implementing a DMARC policy (RFC 7489). A DMARC policy is inherited by all subdomains "unless subdomain policy is explicitly described using the sp tag" (section 6.3). E.g.

    _dmarc.example.com.  IN   TXT   "v=DMARC1; p=reject; aspf=s; adkim=s;"
Improve this answer
1
  • 1
    Solved. It was an issue with Namecheap. Updated the question. Thanks
    – Aditya Singh
    May 21, 2017 at 15:53
1

You should configure DKIM and SPF for the domain you are sending mail for. Given the subdomain mail.example.com. it is likely sending traffic for the example.com domain, and has email addresses like [email protected].

In this case, you need to configure DKIM records under example.com rather than under mail.example.com. The SPF record for example.com could be as simple as v=spf1 a mx -all.

There is no reason why the mail server cannot send mail a different domain such as example.net and/or example.org. For each domain configure DKIM relative to that domain and an SPF record for that domain.

It is useful to define an SPF record for the mail server domain like v=spf1 a -all. This allow SPF validation of the host address.

You should also consider configuring DMARC records. These are defined relative to the domain in the sending email address rather than the domain that is sending the email.

I have posted on Securing your Email Reputation with SPF, Implementing DKIM with Exim and other subjects. The DNS details for DKIM are applicable to all mail servers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .