Important reminder, if you own a domain name and don't use it for sending email.
-
Jerry Lermanreplied to Pteryx the Puzzle Secretary last edited by
@pteryx I set up my own email server on DigitalOcean and instantly got blacklisted by Spamhaus because it was a new domain, and then by another company because the IP address belonged to DigitalOcean.
Most mail servers also flagged it as spam because the domain was less than 60 days old and because it was a .online TLD. For a long time, some of my emails were immediately bounced back or went to spam folders because of all these reasons.
I also believe that every home IP address is automatically blacklisted, which makes it worse for your roommate.
You can eventually overcome it by letting the domain reputation slowly develop and then doing a direct appeal to the blacklist companies. But, it takes a long time.
It's amazing any spam gets delivered.
-
-
@tychotithonus @Jerry
Important: the preference number should be 0.RFC 7505 indicates "no-email" inbound; it's a way for your domain to tell the rest of the world that it does not accept any email from outside.
Don't use it on a domain that's supposed to be hosting the email address in a DMARC 'rua' value.
-
@Aganim
I'm not an expert on this (it's a career), but I know it's not that simple.If I get an unforwarded email, I definitely want both DKIM and SPF to pass. I want only email from an authorized server, and I want an email that is not modified and is properly signed. No exceptions. Both must pass.
If I get email from a mailing list that is sending email to me on behalf of a different domain, I want SPF to pass in that I want to know that the mailing list provider's server is authorized to send email on behalf of the original domain. But, in this case, the original DKIM will fail because the mailing list provider will have changed the email. But, I expect the new DKIM to be correct, or I won't accept it. So, here, a failure on the original DKIM can be acceptable.
If someone forwards an email to me, the original DKIM will fail. I will accept it. But, I want the SPF of the forwarding server to pass, and the new DKIM for the changed email to pass.
There's also email redirection and forwards that happen at the server vs. the client and there can be separate rules for this.
The records can get complicated if you truly want to control different scenarios.
But, you don't always want to accept an email if only 1 check passes.
At least, this is my understading of it all.
-
@Jerry The M3AAWG provides best practices for parked domains, including the recommendation to implement a wildcard DKIM signature.
*._domainkey.example.com TXT “v=DKIM1; p=”
https://www.m3aawg.org/sites/default/files/m3aawg_parked_domains_bp-2015-12.pdf
-
-
@Jerry A null MX is also a good idea for any domain name which is not used for email, though you (obviously) can't set a null MX on a domain used to receive email.
-
@Jerry Great post, as a reminder! I work on this at work, but haven't paid the same attention to my own personal domains.
And just a slight FYI, the SPF TXT record does indeed need to be on the apex/root domain, which, yes, some DNS providers use “@“ as a placeholder for, but that's not what “it is called”. Others, like AWS Route53, don't use that nomenclature. R53 writes out the apex/base domain, e.g. “example.com”, to indicate the apex/root domain.
-
Sharon of the Strange Timesreplied to Jerry Lerman last edited by
@Jerry I have this problem! But I also use my domain for sending post notifications via MailPoet. What are my options?
-
DJM (freelance for hire)replied to Jerry Lerman last edited by
@Jerry If needed, here's a DMARC domain checker https://dmarcian.com/domain-checker/
-
@Jerry great advice. One question: does this config protect also subdomains?
-
@[email protected] There’s also a null MX record for the sake of completeness https://serverfault.com/questions/714052/why-is-rfc-7505-null-mx-necessary
-
@Jerry would adding those txt records cause any issue to a wildcard redirect I use for myself?
I have xxxxx.com and an auto redirect by my dns provider so that anything sent to [email protected] is forwarded to [email protected] so when I give out the address I can see if it's been shared.
I like the idea of protecting against unauthorized use but wouldn't want to lose my throwaway capability.
I find email servers to be akin to dark arts so am at a loss here tbh.
-
Amy (she/her/hers)replied to Jernej Simončič � last edited by
@[email protected] @[email protected] hmm, might have to try that out - planning on restructuring my homelab soon so that could be a good opportunity
atm my main problem is that my homelab, being on residential internet, is on SBL because of my ISP (screw you charter!!) and I've yet to find a reasonable SMTP relay. should I ever find a relay, I'd need to re-set-up DMARC around that -
@Jerry is
@even legal in DNS? (It is not in hostnames, but so is_, so…) -
-
@tychotithonus @Jerry
It will probably work OK with 10 - that's supposed to be a relative number, for when there's more than one MX record and a "main MX / backup MX" disposition is desired.As with line numbers in BASIC, the default is 10 to allow for numbers to be added above and below.
The important part is the null host (single dot).
But I wouldn't want to rely on every other mail server interpreting that correctly. -
@Jerry How in practice can I do this for my site if dynu.com does the dns, and not a dns server I control?
-
Trinity Blair 🥀🔞+ (age in bio or blocked)replied to Jerry Lerman last edited by
@Jerry if you do use your domain for email, is adding these still helpful or unnecessary?
