Important reminder, if you own a domain name and don't use it for sending email.

Trinity Blair 🥀🔞+ (age in bio or blocked)

@Jerry if you do use your domain for email, is adding these still helpful or unnecessary?

Mx Amber Alex (she/it)

Jerry Lerman

@amberage @pteryx
Your points, I think, are very valid. And I live with the fear that I will end up with the same fate.

Jerry Lerman

@trinityblair
If you don't have the 3 records, much of your email that you send will go into spam folders because email clients will have reason to be suspicious of your emails since there's no protection, and eventually, you may see people spoofing your domain, if they aren't trying already.

I have a few domains and I see attempts weekly to spoof my domains, both with domains I don't use for email, and those that I do. Fortunately, the spoofs fail.

My friend had a spoof attempt on his domain 4 weeks ago.

So, yep. You should have an SPF, DKIM and a DMARC record.

Jerry Lerman

@adingbatponder
Can you open a support ticket for help? Or, maybe, they've already done it for you. You can check at https://www.dnsdomainlookup.com/ and pick dns summary from the dropdown.

If you see the spf, dkim, and dmarc records, then you're all set.

Jerry Lerman

@dec23k @tychotithonus
My DNS provider doesn't allow just a dot. Many don't. But saying nobody is allowed to send emails for me (SPF record) should cover it.

Jerry Lerman

@Dero_10 @pteryx
I had that issue a lot when I was running a Linux server in the cloud. It's why I stopped using my own Wireguard VPN server I hosted on Digital Ocean. So many sites would block it.

Jerry Lerman

@mirabilos In some records it is, and even required. It means the "root" or no sub domain name.

Jerry Lerman

@amyipdev @jernej__s
What I learned is that every single home IP address from every single ISP provider is pre-blacklisted by spamhaus and several others I came across. It's not your ISP's fault.

Jerry Lerman

@b3lt3r I'm far from an expert, but if your redirect is at the server, and your server adds a ".forward" to the email, and does not alter anything, you should be fine because your SPF and DKIM should pass.

If your redirect is via an email client, or the server doesn't add a .forward, it may alter the email slightly, but in a way sufficient for DKIM to fail because the hash won't match any longer. But, I think in this case, if SPF passes, your email client would still accept it since the original DKIM passed before the forwarding.

It gets really complicated. Suggest you try it.

And this is based on my understanding, which, who knows?

Jerry Lerman

@momo
Yep, people have mentioned it. I went back to try it and discovered my ISP does not allow a null MX record to be added. If it can be done, it's great, but an SPF that says nobody can send email should do the trick. If you could do, that's better.

Jerry Lerman

@esplovago
Yep.

If you want to have different rules for subdomains, then the records get much more complicated. but "v=spf1 -all" pertains to the domain and subdomains.

Jerry Lerman

@idoubtit
Mailpoet is a Wordpress plugin? You should still have appropriate SPF, DKIM, and DMARC records.

If you gave Mailpoet the right to use your email's SMTP server (is this how it works?) then you're fine because it's using your credentials and SPF will pass as the SMTP server is authorized to send email for your credentials.

Jerry Lerman

@leoncowle Thanks, Leon!

Jerry Lerman

@mkj
Yeah, it is. But not all ISPs allow a null MX record. Mine doesn't (DreamHost). If you can, it's a nice extra protection.

Dale Reardon

@Jerry And if your domain is with Cloudflare they have a tool that can help you set this stuff up really easily - Just a few clicks if not sending emails for example

Ruaphoc

@Jerry

While you are securing your domain, 3 more good ideas:

1. Enable DNSSEC. This will sign the dns query responses to help ensure your DKIM and TLSA can be trusted.

2. Configure CAA records with only your TLS certificate issuer so any other certificates are not trusted.

3. Configure DANE TLSA records with a hash of the public keys for your email server and websites. Also be sure to configure the “mta-sts.@“ subdomain to serve the correct text file. This will provide an additional chain of trust for your email server (and websites server).

Jerry Lerman

@Ruaphoc
Thanks for this! This is on my list to look at this weekend. Thank you!

[email protected]

@Jerry If I change my mind and I want to send e-mails from the domain: Can I expect that this will work, if I change the DNS records file again and wait for TTL seconds? Or will this take considerably longer?

Daniel, pined-lizard edition

@Jerry Can you undo this later without consequence?