Hot answers tagged

59 votes
Accepted

Find DKIM and DMARC Records?

To query the TXT record for DMARC, you can use: dig TXT _dmarc.example.org To query for a particular record for DKIM, you would need to know the selector prefix. You will find it in the s value in an ...
  • 3,561
31 votes

Does DKIM alone not solve the spam issue? Why do I need SPF?

SPF and DKIM are protecting different things altogether: SPF protects the envelope sender whereas DKIM protects the integrity and authenticity of email headers and body. Furthermore, DKIM can only ...
  • 43.3k
26 votes

SPF vs. DKIM - The exact use cases and differences

This was answered some time ago, but I think the accepted answer lacks the point of why both must be used together to be effective. SPF checks the IP of the last SMTP server hop against an authorized ...
  • 361
24 votes

Remove "via" from emails sent to Gmail from Amazon SES

Along with verifying the domain and enabling DKIM on the domain, I also had to enable DKIM on the verified email address I was sending from.
21 votes

Is it becoming impossible to be a small mail provider?

There should be no issues becoming a small mail provider. You seem to be doing the right things. Many large providers don't get things right, and hopefully get most of their mail delivered. If mail ...
  • 27.4k
15 votes
Accepted

DKIM: Can I use a RSA key larger than 2048bit, i.e. 4096?

From IETF RFC 4871 (emphasis added): 3.3.3. Key Sizes Selecting appropriate key sizes is a trade-off between cost, performance, and risk. Since short RSA keys more easily succumb to off-line ...
  • 16.3k
13 votes
Accepted

Is it wrong to leave out the "v=DKIM1;" on a DKIM record?

RFC 6376, which defines DKIM, states the following about the v tag in the key record: v= Version of the DKIM key record (plain-text; RECOMMENDED, default is "DKIM1"). If specified, this ...
  • 1,012
12 votes
Accepted

Mail with DKIM Signature gets T_DKIM_INVALID flag by SpamAssassin

You could give this package a try instead: libmail-dkim-perl One of the walk-throughs linked in the Spamassassin documentation points out a hint that I would recommend to follow: "You should NEVER ...
12 votes
Accepted

Email dkim=temperror (no key for signature)

You don't have a DKIM record matching d=holyfirepublishing.com; s=default; domain / selector. That would be default._domainkey.holyfirepublishing.com. TXT "v=DKIM1; p=yourPublicKey", currently ...
  • 43.3k
11 votes

Does SPF provide benefits along with DKIM+DMARC?

SPF, DKIM, and DMARC all work together to increase trust of your domain and delivery of your email to inboxes. But, the important thing to remember is that the recipient email system is free to handle ...
  • 3,290
10 votes

Find DKIM and DMARC Records?

For DKIM records, if you have received a DKIM-signed email from that domain, look at the DKIM-Signature header line(s). From the spec: All DKIM keys are stored in a subdomain named _domainkey. ...
  • 353
10 votes
Accepted

What does dis=NONE mean in an email's Authentication-Results header?

dis=none (disposition=none) -- means that Gmail applied "none" policy http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/001848.html
  • 7,646
10 votes

Is it becoming impossible to be a small mail provider?

One thing missing in the above (excellent) replies is to set up outbound TLS. Gmail has started to punish senders not using TLS, and other providers aren't saying anything but I'm sure they will ...
10 votes
Accepted

Hosting DKIM records on a separate nameservers

RFC 4871 addresses some concerns for subdomains that are not admistratively related to their parent, I.e. the operator of .com taking control of the example.com DKIM records and that with normal DNS ...
  • 72.5k
10 votes
Accepted

record DKIM on IONOS makes sense?

it is IONOS who signs those emails, right? It would be, if they signed them. But they don't. (But they should.) Here are some excerpts of a conversation I had less than 10 minutes ago with their ...
9 votes
Accepted

Receiving DMARC reports for emails I do not send

I have finally figured out why I was seeing these DMARC reports about properly signed email sent from my domain. As I mentioned in the question, my DMARC record was "v=DMARC1; p=none; pct=100; sp=...
  • 161
9 votes
Accepted

Mail from Teams forwarded to Gmail marked as spam due to DMARC failure

I would assume its Microsofts fault for breaking their signature. The headers clearly say that the signature was good before forwarding, and then broken on receipt by Google. Checking the signed ...
  • 6,875
8 votes
Accepted

DMARC fail, but DKIM and SPF are passing

DMARC does not test if SPF or DKIM has passed, but one of them must both pass and be aligned with the domain used in the From: header. Here, SPF passed with eu-central-1.amazonses.com and DKIM with ...
  • 43.3k
8 votes

Does DKIM alone not solve the spam issue? Why do I need SPF?

While the answer from Esa Jokinen is right, I find the language confusing. Put simply: SPF checks the mail arrived at your server directly from particular agreed authorised mail server(s) or mail ...
8 votes

Does DKIM alone not solve the spam issue? Why do I need SPF?

I think one of the reasons this is hard to satisfactorily answer, is because your core argument seems to be based on a theoretical ideal situation, not on the real world. In principle, is DKIM not ...
  • 181
7 votes

Find DKIM and DMARC Records?

You should use +short with dig to get the DMARC record only. dig +short TXT _dmarc.domain.com
7 votes
Accepted

Postfix - Opendkim - Unable to connect to local socket

Tested on my CentOS6 that postfix seems not really "chrooted". My setting: # /etc/opendkim.conf Socket local:/var/run/opendkim/opendkim.sock # /etc/postfix/main.cf smtpd_milters = unix:/var/run/...
  • 121
7 votes
Accepted

Why do I need to escape ; with \ in a DNS DKIM record?

The choice of what characters are special and require escaping would depend on the nameserver being used as well as what interface is being used to configure the nameserver (for instance if you're ...
  • 19.3k
7 votes

DMARC Alignment: Enforce messages pass BOTH SPF and DKIM

Under the basic assumptions underpinning DMARC, nobody should be able to pass either a DKIM or SPF test as your domain, unless the mail is coming from a server you control. A pass for either of the ...
  • 2,437
7 votes

postfix: connect to Milter service inet:127.0.0.1:8891: Connection refused

As Esa answered, it is related to OpenDKIM. However, through looking at the Service file (Ubuntu 16.04, using systemctl) I noticed that the service uses a file located in /etc/default/opendkim # ...
  • 71
7 votes

DKIM: 'not authenticated' but 'verification successful'

The message seems to come from here in OpenDIM authtype = dkimf_getsymval(ctx, "{auth_type}"); ... if (authtype == NULL || authtype[0] == '\0') { syslog(LOG_INFO, "%s: not authenticated", ...
  • 5,321
7 votes

When DKIM is installed, will I still be able to send email for my domain from gmail?

DomainKeys Identified Mail (DKIM) is for ensuring that mail content hasn't tampered during transmission. Unlike Sender Policy Framework (SPF) it's not trying to validate the source of the message as ...
  • 43.3k
7 votes
Accepted

DMARC reporting unexpected SPF IP but DKIM still passes

I work on the Postmark team and this is a question we get often. When DKIM passes and SPF fails like this it's usually because of message forwarding. For example. Say someone from your domain sends ...
7 votes

How does DKIM work when sending emails from multiple sources/servers?

Explanation The purpose of DKIM is to sign message headers and body, enabling validation of the origin of the message and that it hasn't been modified. A better reputation on some spam filters is just ...
  • 43.3k
6 votes

Domain Key not showing up in DNS query

As indicated in the edit to the question, changing from e.g. default._domainkey.example.com to default._domainkey resolves the problem. It looks like Namecheap appends the domain name, so default....
  • 161

Only top scored, non community-wiki answers of a minimum length are eligible