2

We host our own e-mail but use Sendgrid to send mail on behalf of a few internal PHP services that can't easily handle our mail configuration (e.g. they disallow self-signed certs by default, so getting them to connect to our server to send out things like account activation e-mails is a PITA, like to the point of having to hack the functions of a CMS to pass in an array of config overrides - for the handful of emails this would be, I thought the heck with it and just used Sendgrid's free tier).

I was able to set up our SPF to explicitly allow Sendgrid to send emails on our behalf:

ourdomain.com. IN TXT "v=spf1 mx a ip4:OUR.IP.GOES.HERE/32 include:sendgrid.net -all"

And so there are parallel paths for both mail sent by us and mail sent by Sendgrid to pass both SPF and DKIM. (I didn't do anything special setting up DKIM for ourselves, but it was a bit of a process - FWIW, here's the tutorial I followed.)

But now I want to wrap everything up with DMARC, and Sendgrid emails are failing, even though they pass SPF and DKIM:

Authentication-Results: mx.google.com; dkim=pass [email protected] header.s=smtpapi header.b=eI2rawkZ; spf=pass (google.com: domain of [email protected] designates SENDGRID.IP.GOES.HERE as permitted sender) smtp.mailfrom="[email protected]"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ourdomain.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net; h=from:subject:content-type:content-transfer-encoding:mime-version: x-feedback-id:to; s=smtpapi; bh=AZ+8LE7VkXTKxox/rLn7opOhEWv+baJWKr9E5fUOSKs=; b=eI2rawkZeMvtcJXThu7pufwbVPjRHa5xx46txJj0j9gNNDxNs68y8bcPlj1T9r7rxDK4 oi6e19GMvtdyttXR5WKjg2T+w0p5Ep3Ni6YRQhxq4ZsGcO0mZiRXyNf4BdZ3cOgLKXwECh dMSOaHyK0lR91Xp6eTnOYE7bT9hcRVrWA=

E-mail sent by us is passing:

Authentication-Results: mx.google.com; dkim=pass [email protected] header.s=default header.b=fySBSueO; spf=pass (google.com: domain of [email protected] designates OUR.IP.GOES.HERE as permitted sender) [email protected]; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ourdomain.com

Our DMARC record is set up like this:

_dmarc.ourdomain.com. 299 IN TXT "v=DMARC1\; p=none\; pct=100\; rua=mailto:[email protected]"

Is there a way we can adjust our DNS (or something else?) to permit Sendgrid e-mails to pass the DMARC check? Then we could safely up the recommended 'p' action to 'quarantine' or 'reject'. Although, if it wouldn't be a great drain on our reputation, I'd be happy to leave it at 'none'. It would just be nice to get everything all neatly tied-up, following on from the difficulties I was having before I embarked on the SPF / DKIM / DMARC journey.

2 Answers 2

2

The DKIM signs with d=sendgrid.net and the envelope sender i.e. Return-Path is [email protected]. As both DKIM and SPF validations are using sendgrid.com, it's not aligned with your domain: that's the requirement for DMARC alignment.

Luckily, Sendgrid supports custom domain authentication for both custom DKIM selector and custom return path.

Although, if it wouldn't be a great drain on our reputation, I'd be happy to leave it at 'none'. 

DMARC is not about gaining a better reputation. It's about preventing someone else from using your domain in the From header, which could lead to bad reputation or worse.

3
  • Thanks for replying! So given that what I need is supported by Sendgrid, how do I go about it? It sounds like what I need is a custom return path (see screenshot), but I can't just plug in my domain in the return path field since it only accepts letters and numbers. Am I even barking up the right tree? pasteboard.co/J1xsCXB.png Mar 30, 2020 at 20:54
  • That seems to be a subdomain of your From domain. You could e.g. have sendgrid there and then SPF is authenticated against sendgrid.example.com. TXT "v=spf1 include:sendgrid.net -all", compatible with relaxed mode DMARC. DKIM authentication is even more important, as it survives forwarding. Likewise, with the setting you only customize the selector. Mar 31, 2020 at 3:29
  • Thanks again. Looks like what I really needed was a custom DKIM selector (and I did it in conjunction with automated security). You end up with a bunch of CNAMEs to put into your DNS. I'll do up an answer for myself. Mar 31, 2020 at 23:39
2

So this is definitely specifically for Sendgrid. Processes will vary depending on the particular 3rd party e-mail sender you're trying to use. And even Sendgrid is likely to change its UI.

  1. Be on app.sendgrid.com
  2. Go to Settings > Sender Authentication
  3. Click the "Authenticate Your Domain" button.
  4. Plug in your DNS host. In my case it's definitely not on the list, so I pick "Other Host" and just type it in. I'm also not getting into branding links - I don't care if the links in my automated account admin e-mails have "sendgrid" in the URLS.
  5. Put in the domain you send from, then check "Automated Security" and "Use a custom DKIM selector". [I must admit that I didn't try this process not using a custom selector. We send most of our e-mail out of our own server, and I was worried about messing up my existing setup.] For the DIKM selector, just make something up that you're not using, like maybe "sg" for Sendgrid.
  6. You'll be given a bunch of CNAME records to add to your DNS, like this:

Sendgrid: Install DNS Records

  1. Once those are added (you can use "Send To A Coworker" if you need to give a third party access to the proposed records), you click Verify. You can also check verification status back at the Sender Authentication page. In my case it only partially worked in the beginning - to successfully verify all three records took more than a day. I suspect you'll also have to actually manually try to verify. At least for me, it was a manual try a day or so later that finally worked.

  2. Verify that SPF, DKIM, and DMARC work for both e-mails sent by your server and by Sendgrid! Pop the champagne, if applicable. Move on to the next crisis, if not.

1
  • One little wrinkle: If you have a weird-and-wonky network topology like mine, your own mail server might not make sense of, e.g. em5658.mydomain.com and blithely reject your own sendgrid e-mails to your own users because of the unknown domain. So I blithely added an /etc/hosts record for my equivalent and pointed it at 127.0.0.1. So now Sendgrid can get through to both internal and external users. Apr 8, 2020 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .