0

I followed this guide to setup SPF and DKIM for emails to be sent from a server for a domain. That server is the location of the actual email server for the domain.

I now want to setup another server to be able to send emails from the domain via PHP. Can anyone suggest how this is done? Is it the exact same steps?

Improve this question
2
  • 1
    You'll typically follow the same steps, but rather than regenerating the keys a second time just (securely) copy them from the first server. Note that you can alternatively relay email from the second server through the first one, which would simplify things.
    – tater
    Aug 12, 2020 at 0:53
  • 3
    @tetech: You shouldn't copy the keys between the servers; DKIM explicitly has selectors for allowing multiple sources to sign messages for the same domain without.a need to share the keys.
    – Esa Jokinen
    Aug 12, 2020 at 5:30

1 Answer 1

Reset to default
1

The tutorial you are following explains one basic Postfix+Dovecot setup, as explained in the first part. I don't like the attitude of setting up SPF and DKIM to get through spam filters, as the purpose of SPF is to prevent others from using your domain as an envelope sender and the purpose of DKIM is to authenticate the domain has authorized this message and that the signed contents haven't been modified.

The author of the tutorial has taken some shortcuts, and while he has explained all the steps pretty well and justified some of his own solutions, it says little about what settings could or should be changed to suit your own needs.

SPF

Let's take a look at the record given in the tutorial, and debunk the flaws in the explanation.

TXT  @   "v=spf1 mx ~all"

Explanation:

  • TXT indicates this is a TXT record.
  • Enter @ in the name field.
  • v=spf1 indicates this is an SPF record and the SPF record version is SPF1.

The @ is replaced with the variable in e.g. $ORIGIN example.com., meaning this record would be for the domain apex i.e. example.com. IN TXT.

  • mx means all hosts listed in the MX records are allowed to send emails for your domain and all other hosts are disallowed.

You could use the mx mechanism if the same servers that are used for receiving mail are also sending mail. This is not always true in bigger configurations, and sometimes there are additional sources for outbound mail that won't be used for receiving messages, like newsletter systems. As the mx mechanism requires additional DNS queries first for the MX records and then for the corresponding A records, it's usually better to use ip4 & ip6 mechanisms to tell the allowed IP addresses (or CIDR) directly.

  • ~all indicates that emails from your domain should only come from hosts specified in the SPF record. Emails that are from other hosts will be flagged as forged. Possible alternatives are +all, -all, ?all, but they are rarely used.

The ~ means SoftFail, so it doesn't prevent anyone from using your domain, but may be used for spam scoring. The -all is not "rarely used", but is the probably correct qualifier for generating a hard Fail result allowing rejecting the message altogether.

With these corrections an SPF record for allowing messages from two servers alone would be e.g.

example.com. IN TXT "v=spf1 +ip4:192.0.2.88 +ip4:198.51.100.61 -all"

DKIM

DKIM has selectors (RFC 6376, 3.1) for allowing multiple sources to sign messages for the same domain without sharing the keys. This tutorial uses default as the selector, but could replace it e.g. with the name of the server to make it unique. Then you can have separate signing keys on both servers and publish the public keys accordingly, e.g.

mailserver._domainkey.example.com. IN TXT "v=DKIM1; h=sha256; k=rsa; " "p=...
newsletter._domainkey.example.com. IN TXT "v=DKIM1; h=sha256; k=rsa; " "p=...

A hint: it's easy to see what you should modify if you hilight all the occurrences of word default in the tutorial using the search tool in your browser.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .