Hot answers tagged

103 votes
Accepted

Multiple TXT fields for same subdomain

The way described is the way you create multiple records on Route 53. Entering two values in the textarea separated by a newline will result in two distinct records in the DNS. This is why Amazon ...
Michael Hampton's user avatar
51 votes
Accepted

DNS MX/SPF/DMARC records without actuall emails on domain

The point would largely boil down to being a good citizen and reducing abuse, like making your domain less useful for spammers to impersonate and to make it immediately clear to others that mail is ...
Håkan Lindqvist's user avatar
47 votes

Multiple TXT fields for same subdomain

Michael is correct in regards to where your point of confusion is coming from. I'm going to proceed with my usual stuffiness and answer the larger question for those who might happen by from a Google ...
Andrew B's user avatar
  • 33k
44 votes

Are SPF records legacy?

As @jornane points out, Mailchimp uses their own domain as the envelope sender, making the SPF record of the customer's domain irrelevant for their delivery scheme. This makes DKIM signing ...
Esa Jokinen's user avatar
  • 49.5k
32 votes

Does DKIM alone not solve the spam issue? Why do I need SPF?

SPF and DKIM are protecting different things altogether: SPF protects the envelope sender whereas DKIM protects the integrity and authenticity of email headers and body. Furthermore, DKIM can only ...
Esa Jokinen's user avatar
  • 49.5k
29 votes
Accepted

Strange characters appearing in some DNS checkers, but not others for DKIM and SPF, possibly causing DMARC to fail

FWIW, \239\187\191 is DNS encoding of 3 bytes of decimal values 239, 187, 191 which maps in hexadecimal to EF BB BF, which is the UTF-8 encoding of Unicode codepoint U+FEFF, which is ZERO WIDTH NO-...
Patrick Mevzek's user avatar
27 votes

Multiple TXT fields for same subdomain

If you are using Google Domains, when you edit the TXT record, there's a plus(+) symbol next to the TXT value... click that to add multiple values.
Serj Sagan's user avatar
26 votes

SPF vs. DKIM - The exact use cases and differences

This was answered some time ago, but I think the accepted answer lacks the point of why both must be used together to be effective. SPF checks the IP of the last SMTP server hop against an authorized ...
Pedro's user avatar
  • 361
23 votes
Accepted

SPF record -- why do we use `+a` alongside `+mx`?

Frankly because they have copied the configuration from some tutorial or example configuration without knowing the basic principles of SPF. Sometimes it's desired that e.g. both a web server in a and ...
Esa Jokinen's user avatar
  • 49.5k
22 votes

Are SPF records legacy?

It’s a bit complicated due to the history of SPF, but: MailChimp is technically correct about the SPF record itself (as opposed to providing a TXT record with an SPF policy). They are almost ...
Austin Hemmelgarn's user avatar
21 votes

Is it becoming impossible to be a small mail provider?

There should be no issues becoming a small mail provider. You seem to be doing the right things. Many large providers don't get things right, and hopefully get most of their mail delivered. If mail ...
BillThor's user avatar
  • 27.9k
20 votes
Accepted

How can I have an SPF record longer than 255 characters?

Yes, you are interpreting it correctly. I have recently dealt with this. This article was helpful to me: Can I have a TXT or SPF record longer than 255 characters? A notable example of this ...
pat o.'s user avatar
  • 1,999
20 votes

SPF record -- why do we use `+a` alongside `+mx`?

The task of the hosts listed in MX records is to receive email, not necessarily to deliver email. It's entirely valid (and quite common, particularly for larger operations) to have an asymmetric setup ...
Håkan Lindqvist's user avatar
17 votes
Accepted

SPF fail vs. soft-fail pros and cons

Sondra, you already found a related question, but the highest scoring answer doesn't do justice to your questions, in my opinion. Let me start with your last question: What is the likelihood that a ...
Reinto's user avatar
  • 1,023
16 votes
Accepted

Is there a way to align SPF for Google Apps alias domain?

Use the redirect modifier to "replace" the SPF record for the alias domain with that of the primary domain. Thus, the SPF record for aliasdomain.com ends up looking like this: v=spf1 ...
Mathias R. Jessen's user avatar
14 votes
Accepted

Why don't my domain's messages to a google group get their headers rewritten so DMARC can pass?

I did finally get this response from Google. I was glad to find someone who understood the issue, but unfortunately it looks like Google is sticking with their incorrect treatment of the DMARC ...
lordbyron's user avatar
  • 371
14 votes
Accepted

record DKIM on IONOS makes sense?

it is IONOS who signs those emails, right? It would be, if they signed them. But they don't. (But they should.) Here are some excerpts of a conversation I had less than 10 minutes ago with their ...
JamesTheAwesomeDude's user avatar
14 votes
Accepted

How do I prevent the SPF_HELO_NONE warning when sending from Postfix?

Publish SPF records for HELO/EHLO hostnames The Sender Policy Framework does not only protect MAIL FROM, but also HELO. Whereas the MAIL FROM identity MUST be verified (RFC 7208, 2.4), the ...
Esa Jokinen's user avatar
  • 49.5k
13 votes
Accepted

Should I put Scope:Link or scope:Global IPv6 address in DNS AAAA record?

Yes, precisely so. The globally-scoped address is the one you advertise to the world (which in this case, means list in your AAAA record). The link-scoped address is a very useful feature of ipv6 ...
MadHatter's user avatar
  • 80.4k
13 votes
Accepted

SPF softfail domain does not designate IP as permitted sender

I found a solution, in the end I added the mail server IP to the TXT record and now gmail accepts the sender. If anyone is interested, this is how it looks like: v=spf1 ip4:xxx.xxx.xxx.xxx include:...
muilpp's user avatar
  • 349
13 votes
Accepted

How is this email subverting SPF checks?

In this case they probably said to your server something like this: EHLO www.tchile.com MAIL FROM: [email protected] RCPT TO: [email protected] DATA Date: Thu, 13 Oct 2016 04:03:54 -0300 Message-...
kubanczyk's user avatar
  • 14k
13 votes
Accepted

DMARC reporting unexpected SPF IP but DKIM still passes

I work on the Postmark team and this is a question we get often. When DKIM passes and SPF fails like this it's usually because of message forwarding. For example. Say someone from your domain sends ...
shanerice's user avatar
  • 146
13 votes
Accepted

Can MTA send mail via a relay without being told so?

No, if you don’t configure any relay (and don’t fiddle around on the network layer) , an MTA will try to deliver to whatever DNS says should get the mail.
Sven's user avatar
  • 99.3k
11 votes

How does DKIM work when sending emails from multiple sources/servers?

Explanation The purpose of DKIM is to sign message headers and body, enabling validation of the origin of the message and that it hasn't been modified. A better reputation on some spam filters is just ...
Esa Jokinen's user avatar
  • 49.5k
11 votes

Are SPF records legacy?

The way MailChimp sends out mailings is not compatible with SPF, so it makes sense for them to deprecate it, in the context of them sending on your behalf the way they do. MailChimp wants to handle ...
jornane's user avatar
  • 1,226
11 votes

Does SPF provide benefits along with DKIM+DMARC?

SPF, DKIM, and DMARC all work together to increase trust of your domain and delivery of your email to inboxes. But, the important thing to remember is that the recipient email system is free to handle ...
Appleoddity's user avatar
  • 3,763
10 votes

Is it becoming impossible to be a small mail provider?

One thing missing in the above (excellent) replies is to set up outbound TLS. Gmail has started to punish senders not using TLS, and other providers aren't saying anything but I'm sure they will ...
Matt Sergeant's user avatar
10 votes
Accepted

Hosting DKIM records on a separate nameservers

RFC 4871 addresses some concerns for subdomains that are not admistratively related to their parent, I.e. the operator of .com taking control of the example.com DKIM records and that with normal DNS ...
HBruijn's user avatar
  • 80k
10 votes

Are SPF records legacy?

This is just one vendor's opinion. Yes, they have specific expertise in email deliverability, but so do many other vendors who continue to recommend the use of SPF records. Having a properly ...
joeqwerty's user avatar
  • 111k
10 votes
Accepted

Mail from Teams forwarded to Gmail marked as spam due to DMARC failure

I would assume its Microsofts fault for breaking their signature. The headers clearly say that the signature was good before forwarding, and then broken on receipt by Google. Checking the signed ...
anx's user avatar
  • 9,649

Only top scored, non community-wiki answers of a minimum length are eligible