SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder • Hacker News Board

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#61

Post by slasaus » Wed, Jun 22, 2016, 10:48 AM UTC

medmunds wrote: post #57

slasaus wrote: post #51

Earlier quoted context omitted.

Interesting note about DMARC, but still, if you're concerned about breaking forwarding for your domain, then why bother using spf at all? I still don't see the benefit of setting up ~all rules.

I believe that DMARC requires SPF. Since I want DMARC, I need to provide a compatible SPF, which means ~all. (And I do want to implement DMARC. Not so much to improve deliverability of my own email, but rather to prevent delivery of malicious email pretending to be from my domain.)

Ok, just wondering, would "v=spf1 ?all" be the same in that case? I.e. a neutral spf policy?

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#62

Post by dtemp » Wed, Jun 22, 2016, 3:06 PM UTC

  _domainkey.yoursite.com TXT "t=y; o=~;"

Does anyone know how necessary this entry is, as opposed to just having records beginning with selectors?

It seems like the t=y means that testing is on and to not actually block messages that fail DKIM, and o=~ means that some messages aren't signed. I'm not sure why the article is suggesting people use those settings, since they are entirely variable between different users and their config.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#63

Post by dmuth » Thu, Jun 23, 2016, 1:20 AM UTC

Erwin wrote: post #48

dmuth wrote: post #20

Just to throw this out, I'm the guy responsible for one of the "top 10" DMARC reporting engines on the Internet in terms of volume. If anyone would like to chat about DMARC in the real world or about the DMARC reports (that they are very likely receiving from my employer's domain name), feel free to reach out to me. My email is my username at my username dot org.

Google's Postmaster tools always tell me 100% DKIM, 100% SPF but a crazy varying amount of DMARC success rate. Postmark's weekly report gives me 99.9% DMARC compliance. Do you have an explanation or theory? Our envelope-from often differs from header-From but none of those domains have a strict DMARC alignment policy.

I can't say without more details, but if you can reach out to me privately, I'm more than happy to dig through logs on our mail servers (well, dig through our Splunk platform...) and tell you exactly what we're seeing from your domain.