Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

95

To defeat your enemy, you must know your enemy. What is spam? For our purposes, spam is any unsolicited bulk electronic message. Spam these days is intended to lure unsuspecting users into visiting a (usually shady) web site where they will be asked to buy products, or have malware delivered to their computers, or both. Some spam will deliver malware ...


45

Once DKIM was setup (for help, see this guide) and verified successfully on my domain I still had to enable it in the AWS console at SES -> Domains -> DKIM Once that was done mails to Gmail no longer show up with the via bounces address. You can see it still shows as mailed by: amazonses.com when you view details of the sender but that's OK since ...


37

To query the TXT record for DMARC, you can use: dig TXT _dmarc.example.org To query for a particular record for DKIM, you would need to know the selector prefix. You would then query it as TXT (for example with a google one): dig TXT google._domainkey.example.org


29

I've managed over 100 separate mail environments over the years and have used numerous processes to reduce or help eliminate spam. Technology has evolved over time, so this answer will walk through some of the things I've tried in the past and detail the current state of affairs. A few thoughts about protection... You want to protect port 25 of your ...


24

Partly, I endorse what others have said; partly, I don't. Spamassassin This works very well for me, but you need to spend some time training the Bayesian filter with both ham and spam. Greylisting ewwhite may feel its day has come and gone, but I can't agree. One of my clients asked how effective my various filters were, so here are approximate stats ...


22

You need to split them in the text field. I believe that 2048 is the practical limit for key sizes. Split the text field into parts 255 characters or less. There is overhead for each split. There are two formats for long fields. TXT "part one" \ "part two" TXT ( "part one" "part two" ) Both of which will combine as "part onepart two"...


22

Along with verifying the domain and enabling DKIM on the domain, I also had to enable DKIM on the verified email address I was sending from.


20

There should be no issues becoming a small mail provider. You seem to be doing the right things. Many large providers don't get things right, and hopefully get most of their mail delivered. If mail is being sent to the SPAM folder, it is likely you have missed something. There should be a record of why you have delivery issues: For bounced messages read ...


15

This was answered some time ago, but I think the accepted answer lacks the point of why both must be used together to be effective. SPF checks the IP of the last SMTP server hop against an authorized list. DKIM validates the mail was initially sent by a given domain, and warrantees its integrity. Valid DKIM signed messages can be used as spam or phishing ...


14

I am using a number of techniques which reduce spam to acceptable levels. Delay accepting connections from incorrectly configured servers. A majority of the Spam I receive is from Spambots running on malware infected system. Almost all of these do not pass rDNS validation. Delaying for 30 seconds or so before each response causes most Spambots to give ...


14

SPF has many more rankings than Pass/Fail. Using these in heuristically scoring spam makes the process easier and more accurate. Failing on account of "advanced setups" indicates the mail admin didn't know what he was doing in setting up the SPF record. There's no setup that SPF can't account for correctly. Cryptography doesn't work in absolutes, ever. The ...


12

From IETF RFC 4871 (emphasis added): 3.3.3. Key Sizes Selecting appropriate key sizes is a trade-off between cost, performance, and risk. Since short RSA keys more easily succumb to off-line attacks, signers MUST use RSA keys of at least 1024 bits for long-lived keys. Verifiers MUST be able to validate signatures with keys ranging from 512 bits to ...


11

Your SPF record isn't affecting this. By the looks of it, you have a DMARC record set up, and you are not signing outgoing mail with DKIM. To remedy the problem, either sign the outgoing mail, or remove the DMARC policy. The DMARC record is a TXT record like the SPF record, but it is at _dmarc.example.net where example.net is your domain. If you don't ...


11

You could give this package a try instead: libmail-dkim-perl One of the walk-throughs linked in the Spamassassin documentation points out a hint that I would recommend to follow: "You should NEVER need to use CPAN on a RPM or DEB based Linux distribution."


10

I can't speak for you DKIM key, but your SPF record is set up wrong. You're specifying that the A record, MX record and PTR record are all permitted, and then the +all is saying that any address is valid. If you want to exclude other ip addresses then it needs to be a -all. You'll also want to declare the SPF record as a text record too, as not all mail ...


10

One thing missing in the above (excellent) replies is to set up outbound TLS. Gmail has started to punish senders not using TLS, and other providers aren't saying anything but I'm sure they will follow suit.


10

RFC 4871 addresses some concerns for subdomains that are not admistratively related to their parent, I.e. the operator of .com taking control of the example.com DKIM records and that with normal DNS delegations there is no guarantee where the cut of administrative control is (i.e. with vanity TLD domains such as .walmart compared to walmart.co.uk there is ...


9

I wrote an open source DKIM signing module for Exchange 2007, 2010, 2012, and 2016: https://github.com/Pro/dkim-exchange We are using it now for a few months and didn't have any problems yet.


8

Whether or not you added them to your registrar's DNS servers... I cannot say. What I can say, is that the records are not publicly resolvable. Are you sure you didn't define the records as SRV or A records? If you're 100% sure you added them properly... it's time to call Namecheap... and talk to them. Maybe they have issues hosting TXT records.


8

Thanks to all who tried to help.. The issue was a bug with refile in opendkim when there is CR character in Signingtable file.. So, i saved the file in non DOS format to remove the CR character and it worked perfect...


8

You are using commas to separate your key/value pairs in your record instead of semi-colons. Change it to: a9d04665528b593d263a6e5256648c99._domainkey IN 1800 TXT ( "k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz2/ZfhxSI/A" "bqgh0amM8ylrlosirWeKShUhq7fg12aYmRwOqq9hIzO0Fcz1BzfgHVu6HU++rC5" "QoUK0JQK/nk4jwkDgvG2di2ZYmAvEbY/...


8

SPF and DKIM records for a subdomain would only apply to emails with a from address of that subdomain, i.e. emails from user@subdomain.example.com. They'd be ignored entirely for email from user@example.com.


8

For DKIM records, if you have received a DKIM-signed email from that domain, look at the DKIM-Signature header line(s). From the spec: All DKIM keys are stored in a subdomain named _domainkey. Given a DKIM-Signature field with a "d=" tag of example.com and an "s=" tag of foo.bar, the DNS query will be for foo.bar._domainkey.example.com. So in this ...


7

There is virtually no way to do this within IIS 7.5 (or any version of IIS for that matter). There may be a way to hack it if you write your own module, however that's not so much an IIS hack as it is your own hack that plugs into IIS. There are third party tools that exist to perform this. For example, EA DomainKeys/DKIM for IIS SMTP Service and Exchange ...


7

There are many reasons why a message might be flagged as spam. Having one domain send a message which is signed by a different domain should be more than enough to ensure it is flagged as spam. Quite simply, you need to get everything properly lined up. The signature needs to be the one for the sending domain, not the domain it is sending for. What you have ...


7

I have had similar few months ago. I would recommend you to send an email to check@isnotspam.com then you will get an email back containing all the results and scores. Then I think you will have a clear view of your the problem preventing your messages to get delivered to gmail inbox.


7

Your problem is that you're using an IPv6 address to send mail to google. In itself, that's not a problem except that: You didn't specific the IPv6 address of your MX in your SPF record, thus it will not work Google implements additional requirement for SMTP senders that uses IPv6: Additional guidelines for IPv6 The sending IP must have a PTR ...


7

First of all, please remove these values (they aren't needed if you use KeyTable): Domain example1.com KeyFile /etc/opendkim/keys/example1_com/selc Selector selc Domain example2.com KeyFile /etc/opendkim/keys/example2_com/selc Selector selc Setup your KeyTable like that: mykey1 example1.com:recordname1:/path/to/domain.key mykey2 ...


7

You can use that to generate a sample configuration, but should use openssl to generate your real keys. \\ Generate a private key openssl genrsa -out domainname.com.key 1024 \\ Generate a public key openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM After running those you'll have two files: # lc total 3 -rw-r--r-- 1 chris chris ...


7

E-Mail security sucks. So in the end, you're probably going to be faced with a decision where all your options are terrible, and break different things for different reasons. As for SPF specifically, a mailing list will cause a failure if it forwards a message, without rewriting the headers. A list can configure itself to work however it pleases, so there ...


Only top voted, non community-wiki answers of a minimum length are eligible