Set up SPF, DKIM, and DMARC for your sending domain, check a real message, and fix common DNS and alignment mistakes.

50 points•spy888•about 7 hours ago•20 comments•

20 comments

gerdesjabout 1 hour ago
This was not written by an email admin. Start with the real basics:

Your MTA should announce itself and DNS should agree. So your MTA says: HELO smtp.example.co.uk

smtp.example.co.uk will resolve to an A record (say a.b.c.d) and a reverse lookup will also work:

d.c.b.a.in-addr.arpa PTR smtp.example.co.uk.

Remember this is all about reputation, so if you also DNSSEC sign example.co.uk, then you will look like you care about your domain reputation.

Then do SPF, DKIM and DMARC. Note how the example for SPF stops at ~all and not -all. The rest is also superficial.

Anyway, I run email systems that do the job properly and it is not trivial and certainly not formulaic. There is no shortcut to getting an IP address/range trusted.

The advice on that page is ... good as far as it goes but woefully inadequate for running an email system. It's a good start.

adiabatichottubabout 1 hour ago
I think a better resource is http://www.open-spf.org/
albertgoeswoofabout 1 hour ago
They don’t do ips they just use SES, same as resend and a bunch of other email startups lately
gerdesjabout 1 hour ago
Sorry, what is SES?
duhhhhh1212about 2 hours ago
dolebirchwoodabout 1 hour ago
Is the information actually wrong, misleading, or otherwise deficient?
duhhhhh1212about 1 hour ago
Idk but I’m not wasting my time checking all that. Feel free to give us a detailed line by line analysis of what’s misleading/deficient.

The reason for my comment is that we, the readers, are most likely gonna spend more time reading this post than the author(s) did writing it.

buredorannaabout 3 hours ago
This looks like a pretty good resource.

I'd like to add the following, which I continually reference and has led to repeatable success:

https://www.linuxbabe.com/mail-server/setting-up-dkim-and-sp...

And as far as confirming it works, I continually rely on sending to a gmail address.

Under the three dots is "view original" which gives you

SPF, DKIM, and DMARC results.

(edit:formatting)

jculabout 3 hours ago
This is a cool site to visualise your SPF, DKIM, DMARC setup interactively.

https://www.learndmarc.com/

dbbrabout 2 hours ago
+1. I used this to set up DMARC and ended up signing up for their service. Only like ~$12/year and works.
albertgoeswoofabout 1 hour ago
This is an aws ses wrapper so is basically irrelevant in the email world

Read the full thread on Hacker News →

Related stories