Different technologies are used to verify the validity of email senders. Each technolgy by itself represents only one component of an holistic solution. It is currently recommended to implemtent all three technologies.
The technologies are:
The following figure illustrates the protocol relations.
The use of SPF, DKIM and DMARC are no substitute for email message encryption itself or transport encryption. These technologies are used to identify and asses valid senders and to protect against spam messages.
Keep in mind that SPF, DKIM and DMARC are offerings for other emails servers. As a sending party you do not control if and how SPF, DKIM and DMARC are evaluated by the receiving server. But if evaluated, the configuration must be correct to avoid messages being rejected by receiving email servers.
The following sections focus on the DNS configuration for SPF, DKIM and DMARC. This post is not intended to rate the technologies, but to desribe the implementation.
Each domain being used for sending emails requires a SPF resource record (RR) in its DNS zone. A SPF record is always of the type TXT and does not use any host name (or resource record name, if you will). A SPF RR is always valid for the entire DNS zone.
mcsmemail.de. 3600 IN TXT "v=spf1 mx a:mail.mcsmemail.de ?all"
The following screenshot illustrates adding a new SPF TXT record in a common DNS management interface (DE) of an internet provider. The host name textbox remains empty.
MX server records defined within the DNS zone are valid senders
The additional DNS host name defined as a A resource record is a valid sender as well
Neutral validation of non listed servers that send emails for this domain
SPF records can be created by using one of the various online resources.
DKIM resource records are configured as TXT resource records as well. In contract to a SPF record a host name is mandatory. In this case its called selector.
A DKIM TXT record is always created as a record in the sub domain _domainkey.
nsp._domainkey.mcsmemail.eu. 3600 IN TXT "v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQChZM8yjegaKfd0ssKyezTW/7xbDSNc0uPd50xa5/ecerv1v3mHKM+T7mClzRmIEx+Ji6AisVeo2uvjTYPemHFMBlQpuS/4zc2QxWHqp62FSQ7lASBOzDfUrIwayPVqwSPD6NrnfVSWoUNrFGGSVeU5uLASecBzTfxPukqTHgYKhQIDAQAB"
The following screenshot illustrates adding a new DKIM TXT record in a common DNS management interface (DE) of an internet provider. The host name textbox contains the selector nsp followed by the sub domain _domainkey.
Public key encryption method
The DKIM public key
DMARC is configured as a TXT resource record as well. The DMARC resource record uses the fixed host name _dmarc.
_dmarc.mcsmemail.de. 3600 IN TXT "v=DMARC1\; p=none\; rua=mailto:DMARCRUA@mcsmemail.de\; ruf=mailto:DMARCRUF@mcsmemail.de\; fo=1\; adkim=s\; aspf=s\; rf=afrf\"
The following screenshot illustrates adding a new DMARC TXT record in a common DNS management interface (DE) of an internet provider. The host name textbox contains always the value _dmarc.
No DMARC policy defined (You should always start with None, before switching to Quarantine or Reject)
Email address for status reports
Email address for error reports
Error report type
DKIM alignment, s = strict
SPF alignment, s = strict
Error report message format, afrf = Abuse Report Format nach RFC 5965
The DMARC policy (p) should be raised step-by-step. The results for each policy type are:
Recommended reading on this topic: Google Support Post.
DMARC DNS zone entries can easily be checked by using the Net at Works PowerShell tool. The PowerShell script an only be used with NoSpamProxy11+. But there are some online tools available as well.
You need assistance with your Exchange Server setup? You have questions about your Exchange Server infrastructure and going hybrid with Office 365?
Contact us at email@example.com or visit our website http://www.granikos.eu.