Spam suppression - SPF, DKIM and DMARC
Menu SPF, DKIM and DMARC
 

SPF, DKIM and DMARC

logo

SPF, DKIM and DMARC are all techniques used by email providers to determine the integrity of the message that they are processing. Due to the prevalence of spammers there are many attempts to evade detection and often the methods used to prevent this happening will result in messages not being delivered.

In this world where you have to be careful about what you do online, the subject of spam emails is one that known by all users but rarely understood with respect to how it originates or what is being done to limit the amount you recieve.

How to configure an email service. ---- How to configure custom email addresses

As a webmaster or systems admin there is probably not a lot you can do to control these processes as they are determined by your hosting provider. However, you need to be aware of them so that you can work out why things doen't always work the way that you expect.

Google add another layer to this with ARC - Authenticated Received Chain techniques.

Top

Why are your emails not getting delivered?

When setting up mailers for the Village Hall website I had to come to grips with some of the techniques used to suppress spam. It seems that not everyone is singing the same song sheet.

The good news is that there are solutions to this and things have moved on with the development of technology. It seems that Google, for example, use ARC to provide authenication using a system that was proposed in July 2019. Microsoft, and possibly others such as BTInternet (Yahoo) do not.

So as not to be caught out in the future when I add emails to forms on websites that I am developing a strategy for I have a "Blacklist" test page. The problem is that a php mail() function call does not allow the interception of a "bounce" message as there is no mechanism for this. There probably is but that is in the "too hard basket" for the moment.

SPF - Sender Policy Framework

This seems to be the first port of call for email authentication. If a website/server does not have SPF record in its DNS settings then the message may get rejected. SPF is more effective when used with DKIM and DMARC.

DKIM - DomainKeys Identified Mail

This was defined in a RFC from September 2011.

DMARC - Domain-based Message Authentication, Reporting, and Conformance

From a proposal - March 2015

Comparison

ARC - Authenticated Received Chain

This is used by Google and gmail to add headers to messages that transit intermediate servers.

Below I show the ARC headers that google adds to the meassge resulting in an spf=pass

ARC-Seal: --- ARC-Message-Signature: ---- ARC-Authentication-Results:

resulting in a spf-pass

Wordpress mail server

At the present time, with a day to go, it is not clear to me what the mail server for wordpress.com is. The Domain mapping is renewed with the plan but the Wordpress help also says that you need an upgraded plan to setup the mapping. Seeing that the subscription is going to revert to a "free" subscription from a "Personal" plan. It is not clear whether the mapping will remain. We shall see as I ws told that nothing would be lost. If it is the site will still be accessable at https://belchampwaltervillagehall.wordpress.com

Let's Encrypt

The blacklisting that I was seeing on the tsohost server seems to have been fixed:

" Starting Feb. 19, 2020, Let's Encrypt began making multiple domain validation requests from diverse network vantage points. "

Above is a quote from Let's Encrypt.

TSOHost DNS Settings

You can access these using the mytsohost.com interface.

This section was added as the page had an impression for TSOHost DNS Settings.

Links

Top

References:

  • SPF on WikiPedia - https:// en.wikipedia.org/wiki/ Sender_Policy_Framework
  • Set up SPF in Office 365 to help prevent spoofing - https:// docs.microsoft.com/en-us/microsoft-365/security/office-365-security/ set-up-spf-in-office- 365-to-help-prevent-spoofing
  • DomainKeys Identified Mail - https:// en.wikipedia.org/wiki/ DomainKeys_Identified_Mail
  • Use DMARC to validate email in Office 365 - https:// docs.microsoft.com/ en-us/microsoft-365/ security/office-365-security/ use-dkim-to-validate-outbound-email
  • Authenticated Received Chain - https:// en.wikipedia.org/wiki/ Authenticated_Received_Chain
  • A Technical Deep Dive: Securing the Automation of ACME DNS Challenge Validation - https:// www.eff.org/deeplinks/2018/02/ technical-deep-dive-securing-automation -acme-dns-challenge-validation - EFF - The Electronic Frontier Foundation