This question already has an answer here:

How can a mail server send authenticated mail (using DKIM, SenderID, SPF etc) without adding records to the sending domain name's DNS server?

I've read Jeff Atwood's very useful guide to sending mail so it doesn't end up in spam. I've also read many other articles on the topic, but they all need modification of sending domain name's DNS server.

I'd like to create these records on my mail service's domain name, but authenticate mail from other domain names. MailChimp does this, where you can send mail from any email address (after email verification), but don't need to edit DNS records.

There's this answer which refers to MailChimp setting the Reply-to: header and sending From: a MailChimp email address, but I've checked some campaigns sent to me, and the From: is not a MailChimp address, but the sender's address.

EDIT: Here's a paste of the headers from a MailChimp campaign as seen in Gmail

Can anyone shed some light on how this is done?

marked as duplicate by MadHatter, HopelessN00b, Ward, Roman, Jim B Feb 29 '16 at 16:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Since SPF inherently relies on DNS records, I don't see how this can be done for SPF without rendering one's entire SPF infrastructure insecure. – MadHatter Feb 27 '16 at 8:44
  • Yeah that's what I thought, but MailChimp seem to do it so there must be a way – Michael Bates Feb 27 '16 at 11:24
  • Do you have any evidence that they do? I don't think it's possible, so I'd be surprised if they claim to be able to do it. – MadHatter Feb 27 '16 at 12:54
  • According to mailchimp.com/about/authentication where they say at the bottom that authentication is automatically added to all emails – Michael Bates Feb 27 '16 at 22:09
  • I agree that proves they say they can do it. Do you have any proof that they do do it? An example email from an SPF-secured domain, via MailChimp, complete with all headers, would be most useful. – MadHatter Feb 27 '16 at 22:15

The email you quote in your pastebin doesn't seem to have had an envelope-from address related to the sender:

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounce-mc.us10_40000537.263053-michael=mbates.co@mail185.wdc02.mcdlv.net designates as permitted sender)

Instead, the envelope-from domain is mail185.wdc02.mcdlv.net, which the whois says is registered by the same registrant as has mailchimp.com. Both SPF and SenderID work on the envelope-From, not the header From:, so mailchimp - like any mailing list provider - have solved the problem of SPF and SenderID by rewriting the envelope-From to be their own domain.

(In addition, SenderID may also work one something called the Purported Responsible Address, but since the example you provided did not (despite my request) come from a domain that secures its domains with SPF and SenderID, I can't comment on how mailchimp handles that.)

I can't speak to the choice of From address that DKIM is supposed to secure, because I don't use it, but the domain against which the signature should be evaluated is declared in the record, and oh look:

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=mail185.wdc02.mcdlv.net;

it's in mcdlv.net again.

So the general answer to your question "How can a third-party mail server send authenticated mail (using DKIM, SenderID, SPF etc) without adding records to the sender's domain name's DNS server?" is it can't.

  • Maybe my question wasn't clear, but I stated 'I'd like to create these records on my mail service's domain name, but authenticate mail from other domain names', meaning that I can add DNS records to my domain name, just not the sender's domain name. I'm pretty sure you just answered my question however so thank-you very much for that. – Michael Bates Feb 28 '16 at 10:53
  • That is, you wanted to know how to do what you thought mailchimp does, to wit, send email from other domains that satisfies SPF without making DNS changes to those domains? Hopefully, my answer is pretty clear that you can't, and that mailchimp doesn't. Do feel free to accept my answer if you think it's dealt with your question, though; my apologies if you're already familiar with the etiquette. – MadHatter Feb 28 '16 at 17:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.