We host many email groups. For some, we let people use their own domain or subdomain (email is sent using the (sub)domain and the web archives are also hosted at the (sub)domain). When using a subdomain, we've been having people delegate their subdomain to us, which our DNS then serves (including SPF and DKIM records). We do this instead of having them use a CNAME, because SPF isn't supported over CNAME records.

The problem is that many domain registrars don't support delegating subdomains. Is there another way for us to support people using their own subdomains that is compatible with SPF and DKIM and DMARC? We don't want people to have to set up SPF and other records for our service (we may have to update the records in the future, for example).

  • because SPF isn't supported over CNAME records. false Dec 10 '17 at 2:29

It is good to see a provider worrying about these issues. There is no issue with a mail server sending mail for other domains providing the appropriate SPF configuration is done. While it is a good idea for your clients to have a sub-domain dedicated to the mailing list, it is not necessary for them to delegate it to your server. It could just be a base for the SPF, DKIM and DMARC records.

SPF can be handled by including your SFP record in their SPF record. This will allow them to send from your IP address. You may need to create a subdomain to contain an SFP record suitable for delegation as you should only include IP addresses in that record. (See how google.com and other large providers handle theirs.) This approach is well documented.

DKIM and DMARC will be difficult if your mail servers are not the only ones sending for their domain. If possible, it is possible to have them delegate the _domainkey and _dmarc subdomains to your mail servers. You will need to configure the appropriate zones, but they can all use the same zone definitions.

It may be possible to handle DKIM by having them CNAME the _domainkey subdomain to yours. You will need to sign using their domain and your keys. It gets trickier if the client send mail with other servers. You may need to get them to publish your public key or provide keys for you to use.

It may be possible tho handle DMARC by having them CNAME the _dmarc subdomain to yours. This will result in your policy applying to your domain. Also you will get all the reports. Alternatively, you can provide them assistance in setting up their own policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.