SPF and DKIM - Revision history

Jab: /* DKIM DNS */

2024-03-15T17:50:05Z

DKIM DNS

← Older revision		Revision as of 11:50, 15 March 2024
Line 135:		Line 135:

	Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.		Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.

			* '''_domainkey''' "t=y; o=~;" - is considered the DomainKeys Policy Record
			** o — Outbound Signing policy ('-' means that this domain signs all email, '~' is the default and means that this domain may sign some email with DomainKeys).
			** t — testing mode ('y' means that this domain is testing DomainKeys so unsigned and unverifiable email should not be treated differently from verified email. Recipient systems may wish to track testing mode results to assist the sender.)


	====Multiple Email Hosts with DKIM ====		====Multiple Email Hosts with DKIM ====

Ahat: /* Valid SPF for XMission with additional sending services */

2024-01-05T21:19:45Z

Valid SPF for XMission with additional sending services

← Older revision		Revision as of 15:19, 5 January 2024
Line 95:		Line 95:
	\|-		\|-
	\| XMission plus Gmail, plus Constant Contact \|\| v=spf1 include:_spf.xmission.com include:_spf.google.com include:spf.constantcontact.com -all		\| XMission plus Gmail, plus Constant Contact \|\| v=spf1 include:_spf.xmission.com include:_spf.google.com include:spf.constantcontact.com -all
			\|-
			\| XMission plus your mail server with it's IP range (the IP in this example is for XMission exclusively) \|\| v=spf1 a mx include:_spf.xmission.com ip4:166.70.11.0/24 ~all

	\|}		\|}

Benjii: /* Valid SPF for XMission */

2023-05-23T19:29:20Z

Valid SPF for XMission

← Older revision		Revision as of 13:29, 23 May 2023
Line 69:		Line 69:
	Any SPF record for a domain sending through XMission should contain "include:_spf.xmission.com".		Any SPF record for a domain sending through XMission should contain "include:_spf.xmission.com".

	If you prefer a less identifiable entry then a minimum inclusion would have the following ~~two~~ sources:		If you prefer a less identifiable entry then a minimum inclusion would have the following four sources:
			* ip4:166.70.11.0/24
	* ip4:166.70.13.0/24		* ip4:166.70.13.0/24
			* ip4:166.70.198.0/24
	* ip4:198.60.22.0/24		* ip4:198.60.22.0/24

Benjii: /* DKIM DNS */

2023-03-09T21:33:21Z

DKIM DNS

← Older revision		Revision as of 15:33, 9 March 2023
Line 118:		Line 118:

	== DKIM DNS ==		== DKIM DNS ==
	Add the following two TXT records to the domain. Once added you must [https://xmission.com/contact contact] [mailto:support@xmission.com support@xmission.com] to add your domain to XMission's DKIM routing file and complete the process:		Add the following two TXT records to the domain.

			'''Note''': Once added you must [https://xmission.com/contact contact] [mailto:support@xmission.com support@xmission.com] to add your domain to XMission's DKIM routing file and complete the process:

	{\| class="wikitable"		{\| class="wikitable"
Line 130:		Line 132:
	Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.		Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.

	~~'''~~Multiple Email Hosts with DKIM~~'''~~		====Multiple Email Hosts with DKIM ====

	It is possible to use more than one host with DKIM, though this is only possible if the DNS records used to announce the public key for the security handshake don't share subdomains with each other.		It is possible to use more than one host with DKIM, though this is only possible if the DNS records used to announce the public key for the security handshake don't share subdomains with each other.

	[[Category: Email]]		[[Category: Email]]

Benjii: /* DKIM */

2023-03-09T21:29:43Z

DKIM

← Older revision		Revision as of 15:29, 9 March 2023
Line 107:		Line 107:

	= DKIM =		= DKIM =
			DomainKeys Identified Mail (DKIM) is similar to SPF in that it uses a TXT record on the domain to define a sending policy for that domain. Where it differs is that it uses public key cryptography with this sending policy. A public key is added to that TXT record and any message that is signed with the private key (and thus validates with the public key) is then considered valid.
	~~== How DKIM Works ==~~
	DKIM is similar to SPF in that it uses a TXT record on the domain to define a sending policy for that domain. Where it differs is that it uses public key cryptography with this sending policy. A public key is added to that TXT record and any message that is signed with the private key (and thus validates with the public key) is then considered valid.

	'''DKIM will break automatic responders, like ''Out of Office'' or ''Vacation'' replies.''' This is due to how DKIM verifies the sender, and how automated replies are generated and sent. This is intentional, and is a consideration that needs to be made when limiting sending from your domain via DKIM.		'''DKIM will break automatic responders, like ''Out of Office'' or ''Vacation'' replies.''' This is due to how DKIM verifies the sender, and how automated replies are generated and sent. This is intentional, and is a consideration that needs to be made when limiting sending from your domain via DKIM.
Line 131:		Line 129:

	Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.		Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.


	'''Multiple Email Hosts with DKIM'''		'''Multiple Email Hosts with DKIM'''

Benjii: /* How It Works */

2023-03-09T21:22:41Z

How It Works

← Older revision		Revision as of 15:22, 9 March 2023
Line 30:		Line 30:
	In this case, it says that the A and MX records for the domain are allowed to send, and all other mail fails (but with a "softfail", so that mail isn't actually rejected). "a", "mx" and "all", are all individual mail sources. The "~" prefixed to the "all" source is a policy denoting that mail from the source should be considered a "SoftFail".		In this case, it says that the A and MX records for the domain are allowed to send, and all other mail fails (but with a "softfail", so that mail isn't actually rejected). "a", "mx" and "all", are all individual mail sources. The "~" prefixed to the "all" source is a policy denoting that mail from the source should be considered a "SoftFail".

	The ~~sources are:~~		{\| class="wikitable"
			\|+ Sources & Definitions
			\|-
			! Flag !! Source Type
			\|-
			\| a \|\| DNS A record
			\|-
			\| mx \|\| MX record
			\|-
			\| ptr \|\| PTR record
			\|-
			\| ip4 \|\| IPv4 address or subnet
			\|-
			\| ip6 \|\| IPv6 address or subnet
			\|-
			\| include \|\| The contents of another domain's SPF record
			\|-
			\| all \|\| Any mail source (generally used at the end to provide a default policy)
			\|}

	* a - ~~A DNS A record~~		{\| class="wikitable"
	* mx - ~~An MX record~~		\|+ Prefix Characters
	* ptr - ~~A PTR record~~		\|-
	* ip4 - ~~An ipv4 address or subnet~~		! Prefix !! Definition
	* ip6 - ~~An ipv6 address or subnet~~		\|-
	* include - The contents of another domain'~~s SPF record~~		\| '''+''' \|\| Pass (Valid for SPF)
	* all - ~~Any mail source~~ (~~generally used at the end to provide a default policy~~)		\|-
			\| '''-''' \|\| Fail (Invalid, and reject mail)
			\|-
			\| '''~''' \|\| SoftFail (Invalid, but still accept)
			\|-
			\| '''?''' \|\| Neutral (...whatever...)
			\|}

	~~The prefix characters are:~~		XMission Shared Hosting clients can [https://wiki.xmission.com/Adding/Managing_DNS_Records learn to manage DNS records here.]

	* + - Pass (Valid for SPF)
	* - - Fail (Invalid, and reject mail)
	* ~ - SoftFail (Invalid, but still accept)
	* ? - Neutral (...whatever...)

	XMission ~~shared hosting~~ clients can [https://wiki.xmission.com/Adding/Managing_DNS_Records learn to manage DNS records here.]

	== Valid SPF for XMission ==		== Valid SPF for XMission ==

Benjii: /* Valid SPF for XMission */

2023-03-09T19:11:30Z

Valid SPF for XMission

← Older revision		Revision as of 13:11, 9 March 2023
Line 65:		Line 65:
	\|}		\|}

	~~'''~~Valid SPF for XMission with additional sending services~~'''~~		===Valid SPF for XMission with additional sending services===

	SPF ~~Record Merging~~		Sometimes it is necessary to have mailing list or other services that need to send emails so having multiple SPF records be strung together becomes necessary. Fortunately the fairly lenient syntax of SPF records makes this easy to do, here is our default record compared to some merged records:

	~~Some customers have mailing list or other email sending requirement that require a number~~ of ~~records be strung together in the~~ SPF ~~record. Fortunately the fairly lenient syntax of SPF records makes this easy to do, here is our default record compared to some merged records:~~		{\| class="wikitable"
			! Hosts Generating Emails !! Example of Merged SPF Record
	Default XMission: v=spf1 a mx include:_spf.xmission.com ~all		\|-
			\| Default XMission \|\| v=spf1 a mx include:_spf.xmission.com ~all
	XMission plus Mailchimp: v=spf1 include:_spf.xmission.com include:servers.mcsv.net ~all		\|-
			\| XMission plus Mailchimp \|\| v=spf1 include:_spf.xmission.com include:servers.mcsv.net ~all
	XMission plus Gmail, plus Constant Contact~~: "~~v=spf1 include:_spf.xmission.com include:_spf.google.com include:spf.constantcontact.com -all"		\|-
			\| XMission plus Gmail, plus Constant Contact \|\| v=spf1 include:_spf.xmission.com include:_spf.google.com include:spf.constantcontact.com -all
			\|}

	== Forwarding ==		== Forwarding ==

Tahigh: /* SPF */

2023-03-05T17:17:25Z

SPF

← Older revision		Revision as of 11:17, 5 March 2023
Line 14:		Line 14:
	! Host !! Record Type !! Value		! Host !! Record Type !! Value
	\|-		\|-
	\| @ (base domain) \|\| TXT \|\| v=spf1 a mx include:_spf.xmission.com ~all		\| @ (base domain) \|\| TXT \|\| "v=spf1 a mx include:_spf.xmission.com ~all"
	\|}		\|}

Line 25:		Line 25:
	! Host !! Record Type !! Value		! Host !! Record Type !! Value
	\|-		\|-
	\| @ (base domain) \|\| TXT \|\| v=spf a mx ~all		\| @ (base domain) \|\| TXT \|\| "v=spf a mx ~all"
	\|}		\|}

Line 62:		Line 62:
	! Host !! Record Type !! Value		! Host !! Record Type !! Value
	\|-		\|-
	\| @ (base domain) \|\| TXT \|\| v=spf1 a mx include:_spf.xmission.com ~all		\| @ (base domain) \|\| TXT \|\| "v=spf1 a mx include:_spf.xmission.com ~all"
	\|}		\|}

Tahigh: /* SPF */

2023-03-05T17:16:38Z

SPF

Benjii at 19:31, 1 March 2023

2023-03-01T19:31:05Z

← Older revision		Revision as of 13:31, 1 March 2023
Line 9:		Line 9:

	= SPF =		= SPF =

	The following is the most commonly applied SPF (Sender Policy Framework) record for XMission email customers but it is imperative you understand how and why this is applied. IMPORTANT: It is critical that you read and understand all SPF information below before applying the record to your domain as you could break email delivery.		The following is the most commonly applied SPF (Sender Policy Framework) record for XMission email customers but it is imperative you understand how and why this is applied. IMPORTANT: It is critical that you read and understand all SPF information below before applying the record to your domain as you could break email delivery.

	~~<code><pre>~~		{\| class="wikitable"
	@ IN TXT "v=spf1 a mx include:_spf.xmission.com ~all"		! Host !! Record Type !! Value
	~~</pre></code>~~		\|-
			\| @ (base domain) \|\| TXT \|\| "v=spf1 a mx include:_spf.xmission.com ~all"
			\|}

	== How It Works ==		== How It Works ==

	Any SPF record is a string of one more more potential mail sources, prefixed by a character indicating the policy for mail source. An example of a common SPF record:		Any SPF record is a string of one more more potential mail sources, prefixed by a character indicating the policy for mail source. An example of a common SPF record:

	~~<code><pre>~~		{\| class="wikitable"
	@ IN TXT "v=spf a mx ~all"		\|+ Example Syntax
	~~</pre></code>~~		\|-
			! Host !! Record Type !! Value
			\|-
			\| @ (base domain) \|\| TXT \|\| "v=spf a mx ~all"
			\|}

	In this case, it says that the A and MX records for the domain are allowed to send, and all other mail fails (but with a "softfail", so that mail isn't actually rejected). "a", "mx" and "all", are all individual mail sources. The "~" prefixed to the "all" source is a policy denoting that mail from the source should be considered a "SoftFail".		In this case, it says that the A and MX records for the domain are allowed to send, and all other mail fails (but with a "softfail", so that mail isn't actually rejected). "a", "mx" and "all", are all individual mail sources. The "~" prefixed to the "all" source is a policy denoting that mail from the source should be considered a "SoftFail".
Line 46:		Line 50:

	== Valid SPF for XMission ==		== Valid SPF for XMission ==

	Any SPF record for a domain sending through XMission should contain "include:_spf.xmission.com".		Any SPF record for a domain sending through XMission should contain "include:_spf.xmission.com".

Line 56:		Line 59:
	Note that the SPF record policy is a decision of the domain owner's. If they want to Fail or SoftFail on all, add other sources, etc., is up to them. We don't have a singular recommendation or requirement for SPF. If the customer '''only''' sends via XMission, the following SPF record is relatively safe:		Note that the SPF record policy is a decision of the domain owner's. If they want to Fail or SoftFail on all, add other sources, etc., is up to them. We don't have a singular recommendation or requirement for SPF. If the customer '''only''' sends via XMission, the following SPF record is relatively safe:

	~~<code><pre>~~		{\| class="wikitable"
	@ IN TXT "v=spf1 a mx include:_spf.xmission.com ~all"		! Host !! Record Type !! Value
	~~</pre></code>~~		\|-
			\| @ (base domain) \|\| TXT \|\| "v=spf1 a mx include:_spf.xmission.com ~all"
			\|}

	'''Valid SPF for XMission with additional sending services'''		'''Valid SPF for XMission with additional sending services'''
Line 73:		Line 78:

	== Forwarding ==		== Forwarding ==

	'''Important note''' about forwarding (ie automatically redirecting mail from one email address to another, not hitting the forward button):		'''Important note''' about forwarding (ie automatically redirecting mail from one email address to another, not hitting the forward button):

Line 79:		Line 83:

	== Alias Domains ==		== Alias Domains ==

	Domain aliases that are used for sending email with "From:" addresses will need SPF & DKIM records configured.		Domain aliases that are used for sending email with "From:" addresses will need SPF & DKIM records configured.

Line 87:		Line 90:

	== How DKIM Works ==		== How DKIM Works ==

	DKIM is similar to SPF in that it uses a TXT record on the domain to define a sending policy for that domain. Where it differs is that it uses public key cryptography with this sending policy. A public key is added to that TXT record and any message that is signed with the private key (and thus validates with the public key) is then considered valid.		DKIM is similar to SPF in that it uses a TXT record on the domain to define a sending policy for that domain. Where it differs is that it uses public key cryptography with this sending policy. A public key is added to that TXT record and any message that is signed with the private key (and thus validates with the public key) is then considered valid.

Line 93:		Line 95:

	== Adding DKIM to an XMission Domain ==		== Adding DKIM to an XMission Domain ==

	We have a single private key for XMission DKIM signing. We can sign DKIM with this key on any domain sending out through XMission. It works for Zimbra domains, virtmail, and SMTP relay. To enable this feature for a domain, two things need to happen:		We have a single private key for XMission DKIM signing. We can sign DKIM with this key on any domain sending out through XMission. It works for Zimbra domains, virtmail, and SMTP relay. To enable this feature for a domain, two things need to happen:

	* The domain needs proper DNS for our domainkey key (see below)		* The domain needs proper DNS for our domainkey key (see below)
	* The domain needs to be added to XMission routing config as one with DKIM signing.		* The domain needs to be added to XMission routing config as one with DKIM signing.



	== DKIM DNS ==		== DKIM DNS ==

	Add the following two TXT records to the domain. Once added you must [https://xmission.com/contact contact] [mailto:support@xmission.com support@xmission.com] to add your domain to XMission's DKIM routing file and complete the process:		Add the following two TXT records to the domain. Once added you must [https://xmission.com/contact contact] [mailto:support@xmission.com support@xmission.com] to add your domain to XMission's DKIM routing file and complete the process:

	~~<code><pre>~~		{\| class="wikitable"
	~~FIRST TXT RECORD~~		! Host !! Record Type !! Value
	xmission._domainkey IN TXT "v=DKIM1; t=y; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzWmoe0tzQkSUzMqliwcQQ5zY1HKk4z+Wgp+dRCRe7MmSBPftE9r5Lx1QfTfF/J8gl4k9tFsUvUBap0fk1VGMYUG/2LynVuzpkCI4JlUKF5fbx+MDNZrVi0aX73Edjd9trU6NKldVnhNg1RixDLa4aB04XJviy6+3P1h3IHNaZ0QIDAQAB"		\|-
			\| xmission._domainkey \|\| TXT \|\| "v=DKIM1; t=y; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzWmoe0tzQkSUzMqliwcQQ5zY1HKk4z+Wgp+dRCRe7MmSBPftE9r5Lx1QfTfF/J8gl4k9tFsUvUBap0fk1VGMYUG/2LynVuzpkCI4JlUKF5fbx+MDNZrVi0aX73Edjd9trU6NKldVnhNg1RixDLa4aB04XJviy6+3P1h3IHNaZ0QIDAQAB"
	~~SECOND TXT RECORD~~		\|-
	_domainkey IN TXT "t=y; o=~;"		\| _domainkey \|\| TXT \|\| "t=y; o=~;"
	~~</pre></code>~~		\|}

	Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.		Reminder: XMission DNS systems do not require entry of the quotation marks on the records above. External DNS system may require quotation marks.

← Older revision		Revision as of 11:16, 5 March 2023
Line 14:		Line 14:
	! Host !! Record Type !! Value		! Host !! Record Type !! Value
	\|-		\|-
	\| @ (base domain) \|\| TXT \|\| "v=spf1 a mx include:_spf.xmission.com ~all"		\| @ (base domain) \|\| TXT \|\| v=spf1 a mx include:_spf.xmission.com ~all
	\|}		\|}

Line 25:		Line 25:
	! Host !! Record Type !! Value		! Host !! Record Type !! Value
	\|-		\|-
	\| @ (base domain) \|\| TXT \|\| "v=spf a mx ~all"		\| @ (base domain) \|\| TXT \|\| v=spf a mx ~all
	\|}		\|}

Line 62:		Line 62:
	! Host !! Record Type !! Value		! Host !! Record Type !! Value
	\|-		\|-
	\| @ (base domain) \|\| TXT \|\| "v=spf1 a mx include:_spf.xmission.com ~all"		\| @ (base domain) \|\| TXT \|\| v=spf1 a mx include:_spf.xmission.com ~all
	\|}		\|}

Line 71:		Line 71:
	Some customers have mailing list or other email sending requirement that require a number of records be strung together in the SPF record. Fortunately the fairly lenient syntax of SPF records makes this easy to do, here is our default record compared to some merged records:		Some customers have mailing list or other email sending requirement that require a number of records be strung together in the SPF record. Fortunately the fairly lenient syntax of SPF records makes this easy to do, here is our default record compared to some merged records:

	Default XMission: "v=spf1 a mx include:_spf.xmission.com ~all"		Default XMission: v=spf1 a mx include:_spf.xmission.com ~all

	XMission plus Mailchimp: "v=spf1 include:_spf.xmission.com include:servers.mcsv.net ~all"		XMission plus Mailchimp: v=spf1 include:_spf.xmission.com include:servers.mcsv.net ~all

	XMission plus Gmail, plus Constant Contact: "v=spf1 include:_spf.xmission.com include:_spf.google.com include:spf.constantcontact.com -all"		XMission plus Gmail, plus Constant Contact: "v=spf1 include:_spf.xmission.com include:_spf.google.com include:spf.constantcontact.com -all"