Live data from Hacker News

SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

wpsitecare.com

1–10 of 63 posts

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#3
I think it's pretty weak they're advertising the use of "~all" in their spf records. Either use "-all" or just don't use SPF I would say. If you can't make a decisive statement about your own domain then it won't be actionable for receivers that evaluate your records.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#4
Thanks for posting this. I know it's on a WordPress site but definitely applies to way more people than just that audience. I hope to build the article out even more and get super specific with various vendors like Mandrill, Amazon SES, Sendgrid, etc.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#5
post #3

I think it's pretty weak they're advertising the use of "~all" in their spf records. Either use "-all" or just don't use SPF I would say. If you can't make a decisive statement about your own domain then it won't be actionable for receivers that evaluate your records.

That's a totally fair point. I'm not entirely sure why most third parties are still using ~ in their documentation but it still seems to be the norm. I do like the definitive nature of -all.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#6

I've had great luck with my personal email servers thanks to this tool: https://www.mail-tester.com/ Gives you a score and suggestions on improving it to reduce the chance of hitting the spam filter.

Cool tool. I'll have to play around with that and see how it goes. May end up adding it to the article :)

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#7
I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder:

http://penguindreams.org/blog/how-google-and-microsoft-made-...

I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy over aggressive.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#8
post #7

I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder: http://penguindreams.org/blog/how-google-and-microsoft-made-... I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy ov…

Yeah, no doubt that a sketchy IP will basically negate any kind of authentication you have in place. Off to read your article...

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#9
post #7

I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder: http://penguindreams.org/blog/how-google-and-microsoft-made-... I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy ov…

Have you also set up reverse DNS and done it all for IPv6 too? The second part was what I was missing a while back. I do agree that Google and Microsoft are extremely strict with what they accept and it's not always easy to tell why you get thrown to the spam pile.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#10
A few tips from setting up SPF/DMARC/DKIM for a SAAS service:

* SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include.

* DMARC: to see a strict reject policy, check out Yahoo:

  $ dig +short -t txt _dmarc.yahoo.com
  "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;"
* Mail forwarding: if your app sends mail as the logged-in user, make sure the user's actual email address is not in the FROM address as Yahoo does not authorize you to send FROM: xxxx@yahoo.com

* DMARC emails: use dmarcian.com to parse and process the auto-generated emails

* SPF: use the ~all for your first day of testing and then lock it down to -all after testing is complete

* DKIM: OpenDkim appears to be the most widely supported Linux software package.

* DKIM keys: setup a TXT entry you control and ask client to CNAME it. Then setup key rotation.

Post reply on HN