2

I'm using on one of my domains as hosting provider 101domain.

I know that they don't have a good reputation, but since I have two sites to manage and one of them has multiple ccTLDS domains I wanted to give it a try to their services of hosting aside of multiple registrant service that

I moved all my domains they do give a good service on that. Anyways, 101domain doesn't uses DKIM mechanism and that makes my DMARC policy fail.

Is it possible to setup a DKIM record stating that the mail server isn't signing sent emails?

Example of my records are:

example.com SPF v=spf1 +a +mx ip4:x.x.x.x/16 include:relay.mailchannels.net -all
example.com TXT v=spf1 +a +mx ip4:x.x.x.x/16 include:relay.mailchannels.net -all
_adsp._domainkey.example.com TXT dkim=unknown;
_domainkey.example.com TXT o=~
_dmarc.example.com TXT v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=s;

PD: 101domain uses mail channels.net service for sent mails gateway.

Improve this question

2 Answers 2

Reset to default
3

You can remove all the records related to DKIM.
DMARC does not require that you use both SPF and DKIM. When validating DMARC, it is only required that the mail passes a DKIM or an SPF check, not both.

There are of course a lot of benefits from using DKIM also, but if you don't have it, simply remove all the records.

If DMARC fails something is wrong with the SPF check or the DMARC check where it checks the Mail from and Display From headers and there is a mismatch.

DMARC.org has a good article regarding using DMARC without DKIM

Improve this answer
3
  • 1
    "DMARC does not require that you use both SPF and DKIM. When validating DMARC, it is only required that the mail passes a DKIM or a DMARC check": just for the avoidance of doubt, can you confirm you didn't mean "a DKIM or an SPF check"? I apologise for not immediately getting the point.
    – MadHatter
    Jul 30, 2018 at 8:50
  • @MadHatter You are entirely right, must have been a brainfart from my part. Edited so it now makes sense :) Thanks.
    – Henrik Stanley Mortensen
    Jul 30, 2018 at 8:52
  • 1
    No worries, and thanks. I've done another small fixup which I hope is OK. +1 from me.
    – MadHatter
    Jul 30, 2018 at 8:56
0

Well thanks to MadHatter and Henrik Stanley Mortensen for you're help, but doing some research and making some test I found out that when you set the DKIM record to revoke the public key, it seems like the policy goes to neutral making the emails without being signed be valid through DKIM checks.

default._domainkey.example.com TXT k=rsa; p=

The checks of DMARC, will depend of which policy you use.

_dmarc.example.com TXT v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=s; aspf=s;

If you set both DKIM and SPF to strict mode, then if one of the checks fails, the email will be rejected.

_dmarc.example.com TXT v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=s;

On the other side, if you set DKIM relaxed and SPF strict mode, then if DKIM fails and SPF pass, the email will get through but if DKIM passes and SPF fails, the email will be rejected.

_dmarc.example.com TXT v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=r;

Further more, if you set both DKIM and SPF to relax mode, is the same result as setting the policy to NONE.

Improve this answer
1
  • Neither DKIM nor SPF is mandatory so we can't estimate strict policy from any remote host. Using of DKIM/SPF/DMARC is a matter of good will only so it is a bad idea to set own policy to the strict mode. Google do a good thing forcing postmasters to setup DKIM/SPF/DMARC at least in the relaxed mode. But who knows when those technics becomes mandatory strict for all.
    – Kondybas
    Jul 31, 2018 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .