32
votes
Does DKIM alone not solve the spam issue? Why do I need SPF?
SPF and DKIM are protecting different things altogether: SPF protects the envelope sender whereas DKIM protects the integrity and authenticity of email headers and body. Furthermore, DKIM can only ...
- 48k
26
votes
SPF vs. DKIM - The exact use cases and differences
This was answered some time ago, but I think the accepted answer lacks the point of why both must be used together to be effective.
SPF checks the IP of the last SMTP server hop against an authorized ...
- 361
21
votes
Is it becoming impossible to be a small mail provider?
There should be no issues becoming a small mail provider. You seem to be doing the right things. Many large providers don't get things right, and hopefully get most of their mail delivered.
If mail ...
- 27.8k
18
votes
Accepted
Is it wrong to leave out the "v=DKIM1;" on a DKIM record?
RFC 6376, which defines DKIM, states the following about the v tag in the key record:
v= Version of the DKIM key record (plain-text; RECOMMENDED, default
is "DKIM1"). If specified, this ...
- 1,082
17
votes
Accepted
DKIM: Can I use a RSA key larger than 2048bit, i.e. 4096?
From IETF RFC 4871 (emphasis added):
3.3.3. Key Sizes
Selecting appropriate key sizes is a trade-off between cost, performance, and risk. Since short RSA keys more easily succumb to off-line ...
- 16.9k
16
votes
Accepted
Email dkim=temperror (no key for signature)
You don't have a DKIM record matching d=holyfirepublishing.com; s=default; domain / selector. That would be default._domainkey.holyfirepublishing.com. TXT "v=DKIM1; p=yourPublicKey", currently ...
- 48k
14
votes
Accepted
record DKIM on IONOS makes sense?
it is IONOS who signs those emails, right?
It would be, if they signed them. But they don't. (But they should.)
Here are some excerpts of a conversation I had less than 10 minutes ago with their ...
12
votes
Find DKIM and DMARC Records?
For DKIM records, if you have received a DKIM-signed email from that domain, look at the DKIM-Signature header line(s).
From the spec:
All DKIM keys are stored in a subdomain named _domainkey. ...
- 393
12
votes
Accepted
What does dis=NONE mean in an email's Authentication-Results header?
dis=none (disposition=none) -- means that Gmail applied "none" policy
http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/001848.html
- 7,936
12
votes
Accepted
Mail with DKIM Signature gets T_DKIM_INVALID flag by SpamAssassin
You could give this package a try instead: libmail-dkim-perl
One of the walk-throughs linked in the Spamassassin documentation points out a hint that I would recommend to follow:
"You should NEVER ...
- 968
11
votes
How does DKIM work when sending emails from multiple sources/servers?
Explanation
The purpose of DKIM is to sign message headers and body, enabling validation of the origin of the message and that it hasn't been modified. A better reputation on some spam filters is just ...
- 48k
11
votes
Does SPF provide benefits along with DKIM+DMARC?
SPF, DKIM, and DMARC all work together to increase trust of your domain and delivery of your email to inboxes. But, the important thing to remember is that the recipient email system is free to handle ...
- 3,648
10
votes
Is it becoming impossible to be a small mail provider?
One thing missing in the above (excellent) replies is to set up outbound TLS. Gmail has started to punish senders not using TLS, and other providers aren't saying anything but I'm sure they will ...
- 514
10
votes
Accepted
Hosting DKIM records on a separate nameservers
RFC 4871 addresses some concerns for subdomains that are not admistratively related to their parent, I.e. the operator of .com taking control of the example.com DKIM records and that with normal DNS ...
- 78.7k
10
votes
Accepted
Mail from Teams forwarded to Gmail marked as spam due to DMARC failure
I would assume its Microsofts fault for breaking their signature. The headers clearly say that the signature was good before forwarding, and then broken on receipt by Google. Checking the signed ...
- 9,371
9
votes
Accepted
Receiving DMARC reports for emails I do not send
I have finally figured out why I was seeing these DMARC reports about properly signed email sent from my domain.
As I mentioned in the question, my DMARC record was "v=DMARC1; p=none; pct=100; sp=...
- 161
9
votes
Accepted
DMARC reporting unexpected SPF IP but DKIM still passes
I work on the Postmark team and this is a question we get often. When DKIM passes and SPF fails like this it's usually because of message forwarding.
For example. Say someone from your domain sends ...
- 106
9
votes
Accepted
DMARC fail, but DKIM and SPF are passing
DMARC does not test if SPF or DKIM has passed, but one of them must both pass and be aligned with the domain used in the From: header. Here, SPF passed with eu-central-1.amazonses.com and DKIM with ...
- 48k
8
votes
Find DKIM and DMARC Records?
You should use +short with dig to get the DMARC record only.
dig +short TXT _dmarc.domain.com
- 681
8
votes
postfix: connect to Milter service inet:127.0.0.1:8891: Connection refused
As Esa answered, it is related to OpenDKIM.
However, through looking at the Service file (Ubuntu 16.04, using systemctl) I noticed that the service uses a file located in /etc/default/opendkim
# ...
- 81
8
votes
DKIM: 'not authenticated' but 'verification successful'
The message seems to come from here in OpenDIM
authtype = dkimf_getsymval(ctx, "{auth_type}");
...
if (authtype == NULL || authtype[0] == '\0')
{
syslog(LOG_INFO, "%s: not authenticated",
...
- 5,401
8
votes
Accepted
opendkim-testkey: key not secure
As also explained in my other answer, key not secure in this context indicates that OpenDKIM was not able to authenticate the key using DNSSEC.
You have to ensure that OpenDKIM can make use of DNSSEC. ...
- 905
8
votes
Does DKIM alone not solve the spam issue? Why do I need SPF?
While the answer from Esa Jokinen is right, I find the language confusing.
Put simply:
SPF checks the mail arrived at your server directly from particular agreed authorised mail server(s) or mail ...
- 317
8
votes
Does DKIM alone not solve the spam issue? Why do I need SPF?
I think one of the reasons this is hard to satisfactorily answer, is because your core argument seems to be based on a theoretical ideal situation, not on the real world.
In principle, is DKIM not ...
- 181
7
votes
Domain Key not showing up in DNS query
As indicated in the edit to the question, changing from e.g. default._domainkey.example.com to default._domainkey resolves the problem.
It looks like Namecheap appends the domain name, so default....
- 171
7
votes
Accepted
Postfix - Opendkim - Unable to connect to local socket
Tested on my CentOS6 that postfix seems not really "chrooted".
My setting:
# /etc/opendkim.conf
Socket local:/var/run/opendkim/opendkim.sock
# /etc/postfix/main.cf
smtpd_milters = unix:/var/run/...
- 121
7
votes
Accepted
Why do I need to escape ; with \ in a DNS DKIM record?
The choice of what characters are special and require escaping would depend on the nameserver being used as well as what interface is being used to configure the nameserver (for instance if you're ...
- 19.6k
7
votes
DMARC Alignment: Enforce messages pass BOTH SPF and DKIM
Under the basic assumptions underpinning DMARC, nobody should be able to pass either a DKIM or SPF test as your domain, unless the mail is coming from a server you control. A pass for either of the ...
- 2,567
7
votes
postfix: connect to Milter service inet:127.0.0.1:8891: Connection refused
OpenDKIM is a different service. See whether it's running or not. You could try
sudo service opendkim restart
and see if that results in an error.
Given that you have Socket inet:[email protected] ...
- 48k
7
votes
When DKIM is installed, will I still be able to send email for my domain from gmail?
DomainKeys Identified Mail (DKIM) is for ensuring that mail content hasn't tampered during transmission. Unlike Sender Policy Framework (SPF) it's not trying to validate the source of the message as ...
- 48k
Only top scored, non community-wiki answers of a minimum length are eligible