{"id":1731,"date":"2014-12-22T10:00:02","date_gmt":"2014-12-22T16:00:02","guid":{"rendered":"https:\/\/www.foell.org\/justin\/?p=1731"},"modified":"2014-12-20T22:34:31","modified_gmt":"2014-12-21T04:34:31","slug":"gmail-extras-spf-dmarc-dkim-bind","status":"publish","type":"post","link":"https:\/\/www.foell.org\/justin\/gmail-extras-spf-dmarc-dkim-bind\/","title":{"rendered":"Gmail extras SPF, DMARC, &#038; DKIM with Bind"},"content":{"rendered":"<p>When the internet really started catching steam, email was one of it&#8217;s flagship services. Back then it was simple but somewhat archaic &#8211; it&#8217;s goal was to be redundant enough to get your message through even if it required several tries. It was the digital equivalent of:<\/p>\n<blockquote><p>Neither snow nor rain nor heat nor gloom of night stays these couriers from the swift completion of their appointed rounds.<\/p><\/blockquote>\n<p>Think of all the stuff that has been added atop of email\u00a0such as encryption and MIME encoding to send attachments. But it was our must-deliver mantra that was used by the spammers for their personal gain. Then even more\u00a0layers for spam and virus filtering were added. Spammers have sort of negated that &#8220;must deliver&#8221; image of email to where I click send and think,\u00a0&#8220;I hope it will be delivered.&#8221;<\/p>\n<p><!--more--><\/p>\n<h2>God Save the Email Administrator<\/h2>\n<p>I used to manage my own email server. Postfix SMTP, Courier POP\/IMAP, Amavis\/Freshclam SPAM &amp; Antivirus. I don&#8217;t like being an email administrator. It&#8217;s frankly too much to keep up with. I just want email to <em>work<\/em>. Recently I switched my self-managed email to google mail. I figured it would be a set-it-and-forget-it type of deal. I was wrong.<\/p>\n<p>The reason I still had issues is because I still wanted control of my DNS. Turns out there is a lot contained within DNS besides <a title=\"Google Apps MX record values\" href=\"https:\/\/support.google.com\/a\/answer\/174125?hl=en\" target=\"_blank\">MX records<\/a> that can effect mail delivery. I found this <a title=\"TXT record values\" href=\"https:\/\/support.google.com\/a\/answer\/2716802\" target=\"_blank\">DNS TXT record page at google<\/a> that got me started, but each individual entry could use some additional explanation.<\/p>\n<h2>SPF Records<\/h2>\n<p>Before moving to google, I had added this SPF record:<\/p>\n<pre>                IN      SPF     \"v=spf1 mx a ip4:198.58.117.237 -all\"\r\n                IN      TXT     \"v=spf1 mx a ip4:198.58.117.237 -all\"\r\n<\/pre>\n<p>I&#8217;m not sure why the SPF record exists on its own and in a TXT record, but I don&#8217;t really care, as long as email goes through. <strong>But it wasn&#8217;t going through.<\/strong> The problem with this set up is, it tells the receiver that anything received from my domain is good if it came from my server IP (mostly system &amp; website generated notifications). But my google mail comes from google, not my IP. So I was getting bounce-backs from picky providers. The solution was to add google into the mix and loosen the failure type on the &#8220;all&#8221; mechanism:<\/p>\n<pre>                IN      SPF     \"v=spf1 mx a ip4:198.58.117.237 include:_spf.google.com ~all\"\r\n                IN      TXT     \"v=spf1 mx a ip4:198.58.117.237 include:_spf.google.com ~all\"\r\n<\/pre>\n<h2>Google Site Verification<\/h2>\n<p>This is one of those things you probably already did by putting a HTML file on your site to prove to google that you own it. This gives your ownership even more credibility. It&#8217;s not required for email delivery, but since I was going over the list of TXT records, I figured I&#8217;d add it. Locating this section in the webmaster tools\u00a0is tricky, so I made a video:<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe loading=\"lazy\" class=\"youtube-player\" width=\"770\" height=\"434\" src=\"https:\/\/www.youtube.com\/embed\/_MkBRPwM4OI?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\"><\/iframe><\/span><\/p>\n<p>Add the verification key to your DNS file:<\/p>\n<pre>                IN      TXT     \"google-site-verification=DqPNHNAJ5DnBpLr1TzZe38vQucZZ49wnCGiU9e75RTo\"\r\n<\/pre>\n<p>After saving your changes and restarting bind, you can test to make sure your new TXT entries are showing using <code>dig<\/code>. I recommend using the &#8216;@nameserver&#8217; parameter so you can query\u00a0your own nameserver before the changes have propagated internet-wide.<\/p>\n<pre>$ dig @ns.foell.org TXT foell.org\r\n...\r\n;; QUESTION SECTION:\r\n;foell.org.\t\t\tIN\tTXT\r\n\r\n;; ANSWER SECTION:\r\nfoell.org.\t\t604800\tIN\tTXT\t\"v=spf1 mx a ip4:198.58.117.237 include:_spf.google.com ~all\"\r\nfoell.org.\t\t604800\tIN\tTXT\t\"google-site-verification=DqPNHNAJ5DnBpLr1TzZe38vQucZZ49wnCGiU9e75RTo\"\r\n<\/pre>\n<h2>DKIM<\/h2>\n<p>I don&#8217;t know the full details of how <a title=\"Authenticate email with DKIM\" href=\"https:\/\/support.google.com\/a\/answer\/174124?hl=en\" target=\"_blank\">DKIM<\/a> works, but it&#8217;s an encryption key added to your domain name which helps insure that the email received was sent from who you think it was. It works because your email provider (google) adds a DKIM domain key to the header of\u00a0the email, and the receiver can validate it by using the DKIM public key saved on your DNS record.<\/p>\n<p>Here&#8217;s how to get your DKIM key:<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe loading=\"lazy\" class=\"youtube-player\" width=\"770\" height=\"434\" src=\"https:\/\/www.youtube.com\/embed\/bWij-nvIGZ8?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\"><\/iframe><\/span><\/p>\n<p>Add it to your DNS file:<\/p>\n<pre>google._domainkey IN    TXT     \"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnCPVKm4lCMECaU\/eFOQewJaGpAk\/hx4D8pQCRQ+Iq1Y7pUL09iyFImWRveBTBRccOEy\/gchsZoseBVMvAS4L86GQhUgi+4tk4VvpxkQLgbuPouoLs54W4kIDUhgZcmNe4fBjoIMgHQvRfXc1G6MnwBZcU3a0URtxfhExFCflfUwIDAQAB\"\r\n<\/pre>\n<p>Verify that it has been saved using <code>dig<\/code><\/p>\n<pre>$ dig @ns.foell.org TXT google._domainkey.foell.org\r\n<\/pre>\n<h2>DMARC<\/h2>\n<p><a title=\"Prevent outgoing spam with DMARC\" href=\"https:\/\/support.google.com\/a\/answer\/2466580\" target=\"_blank\">DMARC<\/a> combines both DKIM and SPF to combat phishing and protect your domain&#8217;s reputation. I added this to my bind resource record:<\/p>\n<pre>_dmarc          IN      TXT     \"v=DMARC1; p=quarantine\\; pct=100\\; rua=mailto:postmaster@foell.org\"\r\n<\/pre>\n<p>Test using <code>dig<\/code><\/p>\n<pre>$ dig @ns.foell.org TXT _dmarc.foell.org\r\n<\/pre>\n<p>Again, I&#8217;m not exactly sure how it all works, but I now get informational reports from servers that I&#8217;ve sent emails to, letting me know my &#8220;standing&#8221; from an email perspective as they see it. I don&#8217;t plan on being proactive about them, but they&#8217;ll be useful if I start getting bounce messages again.<\/p>\n<div class='kindleWidget kindleLight' ><img decoding=\"async\" src=\"https:\/\/www.foell.org\/justin\/wp-content\/plugins\/send-to-kindle\/media\/white-15.png\" \/><span>Send to Kindle<\/span><\/div>","protected":false},"excerpt":{"rendered":"<p>When the internet really started catching steam, email was one of it&#8217;s flagship services. Back then it was simple but somewhat archaic &#8211; it&#8217;s goal was to be redundant enough to get your message through even if it required several tries. It was the digital equivalent of: Neither snow nor rain nor heat nor gloom&hellip; <a href=\"https:\/\/www.foell.org\/justin\/gmail-extras-spf-dmarc-dkim-bind\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Email and DNS are sometimes tricky, even with Gmail","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1,17],"tags":[61],"class_list":["post-1731","post","type-post","status-publish","format-standard","hentry","category-business","category-dns","tag-bind"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/posts\/1731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/comments?post=1731"}],"version-history":[{"count":7,"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/posts\/1731\/revisions"}],"predecessor-version":[{"id":1738,"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/posts\/1731\/revisions\/1738"}],"wp:attachment":[{"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/media?parent=1731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/categories?post=1731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.foell.org\/justin\/wp-json\/wp\/v2\/tags?post=1731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}