Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

wpsitecare.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#41

Post by cebka »

talideon wrote: post #18
edutechnion wrote: post #10

A few tips from setting up SPF/DMARC/DKIM for a SAAS service: * SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include. * DMARC: to see a strict reject policy, check out Yahoo: $ dig +short -t txt _dmarc.yahoo.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;" * Mail forwarding: if your app sends…

For DKIM, rspamd/rmilter are a great alternative to OpenDKIM if you want to build the DKIM check into your regular spam checks. One minor downside of rmilter is that it will only sign the headers of mail sent by by authenticated users. This isn't a huge deal, but can be a bit of an irritation.

Rmilter now can sign mail that come from certain networks as well.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#42

Post by logicallee »

I don't like the implication that the work outlined in this article is reasonable.

Imagine if there were a detailed guide on how to keep the post office from throwing out the letters you send?

Because mail that you personally send out by definition isn't spam - so you are doing work to get around broken spam filters.

why can't you just pay $10 or something as a deposit and, since you're not actually a spammer and nobody will ever actually mark what you send as spam, never lose that deposit.

This guide should be like four lines long and take 5 mi utes to follow.

I mean after glancing at that write-up, I'd never dream of running my own mail server. I use gmail. Why would I jump through hoops and still risk having letters I took the time to write, still marked as spam? I lose on two counts! (invest time, for a worse outcome.)

This part of the industry is broken. I think a deposit paid by non-spammers which they lose if people start marking their letters spam, might fix it.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#43

Post by tnorthcutt »

slasaus wrote: post #3

I think it's pretty weak they're advertising the use of "~all" in their spf records. Either use "-all" or just don't use SPF I would say. If you can't make a decisive statement about your own domain then it won't be actionable for receivers that evaluate your records.

Google specifically says[0]:

Create a TXT record containing this text: v=spf1 include:_spf.google.com ~all

Publishing an SPF record that uses -all instead of ~all may result in delivery problems. See Google IP address ranges for details about the addresses for the Google Apps mail servers.

[0]: https://support.google.com/a/answer/178723?hl=en

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#44

Post by specialp »

I have found that the site https://mxtoolbox.com/ is very good for scanning your records for SPF/DMARC/DKIM and pointing out problems. Unfortunately even with implementing all of this some email providers are heavy handed with rejecting mail from smaller mail servers. For instance Yahoo will usually block all of your mail without appealing to them, and Verizon will not allow any email originating from a VPS source like Digital Ocean or AWS. Ironically I found that out when going to report someone on Verizon's network trying to brute force my SMTP server. Mail to abuse was rejected.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#45

Post by wpBenny »

edutechnion wrote: post #10

A few tips from setting up SPF/DMARC/DKIM for a SAAS service: * SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include. * DMARC: to see a strict reject policy, check out Yahoo: $ dig +short -t txt _dmarc.yahoo.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;" * Mail forwarding: if your app sends…

Thanks for the tips

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#46

Post by unethical_ban »

I resent that IP block based filtering is done anymore. Legit people are using VPS to send email, and email is a fundamental decentralized protocol of the internet. It's really crappy that in this age of DKIM/SPF/DMARC, we can't do away with IP filtering.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#47

Post by Erwin »

chewmieser wrote: post #2

I've had great luck with my personal email servers thanks to this tool: https://www.mail-tester.com/ Gives you a score and suggestions on improving it to reduce the chance of hitting the spam filter.

For something more complete: https://glockapps.com/

This gives you (in the paid version) a "seed list" of emails at various ISPs, so you can see how your email does with gmail vs yahoo. This is one of the several services, but the one we're most happy with.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#48

Post by Erwin »

dmuth wrote: post #20

Just to throw this out, I'm the guy responsible for one of the "top 10" DMARC reporting engines on the Internet in terms of volume. If anyone would like to chat about DMARC in the real world or about the DMARC reports (that they are very likely receiving from my employer's domain name), feel free to reach out to me. My email is my username at my username dot org.

Google's Postmaster tools always tell me 100% DKIM, 100% SPF but a crazy varying amount of DMARC success rate. Postmark's weekly report gives me 99.9% DMARC compliance. Do you have an explanation or theory? Our envelope-from often differs from header-From but none of those domains have a strict DMARC alignment policy.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#49

Post by brightball »

Sendgrid has a nice implementation for DKIM too. They setup 2 DKIM CNAME records that point to a DNS entry with a id number in it for you. Periodically, they rotate DKIM keys and by having the 2 CNAME's they can easily transition without concerns about something getting lost in transit.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#50

Post by medmunds »

justinc8687 wrote: post #39
justinc8687 wrote: post #38

Earlier quoted context omitted.

I run a small Saas company that does mail forwarding as you mentioned above ("send mail as the logged-in user"). If not putting the user's email as FROM, how do you recommend handling it?

I should note, I current set the FROM as "John Smith " and set Reply-To to their actual email. That said, I've seen a number of clients ignore the Reply To and send email to the donotreply.

You're doing it right. The important part to avoid DMARC filtering is that the actual email address in the From field match your actual sending domain. The display name doesn't matter (for DMARC filtering).

However, there's another problem: Many email clients hide the email address part by default, and only show the display name. So the recipients may not see "donotreply" without some extra clicking. Worse, if that address gets auto-added to their address book, they may accidentally send to it later: the client autocompletes "John Smith", and the user doesn't realize it's actually your donotreply email.

One way to cut down on this is to include your company in the display name. I usually use:

    From: "John Smith via ExampleCo"
but have also had good results (delivery and open rates) with:

    From: "ExampleCo for John Smith"
Post reply on HN