{"id":442,"date":"2020-10-15T17:43:21","date_gmt":"2020-10-15T17:43:21","guid":{"rendered":"https:\/\/dft.wiki\/?p=442"},"modified":"2024-02-16T16:31:18","modified_gmt":"2024-02-16T21:31:18","slug":"sender-framework-policy-spf","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=442","title":{"rendered":"SPF + DKIM + DMARC Overview"},"content":{"rendered":"<p>Tools against SPAM and domain spoofing:<\/p>\n<ul>\n<li><strong>SPF<\/strong> &#8211; Whitelist of hosts that are allowed to send email on behalf of the organization.<\/li>\n<li><strong>DKIM<\/strong> &#8211; Digital signatures (keys) used to verify if the message really came from the organization.<\/li>\n<li><strong>DMARC<\/strong> &#8211; Tells the receiver servers what todo with the emails that fail SPF and\/or DKIM.<\/li>\n<\/ul>\n<hr \/>\n<p><strong>SFP (Sender Framework Policy)<\/strong> is one more weapon to fight E-Mail Spam.<\/p>\n<p>The idea is to use the DNS records (TXT format) to advertise what sources are legitimately allowed to originate email for your domain, reduce the chances of spoofing. See example:<\/p>\n<ul>\n<li>Record name\n<ul>\n<li><strong>(empty) or &#8220;*&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Value\n<ul>\n<li><strong>&#8220;v=spf1 a mx include:mailvendor.com ~all&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Configure your DNS<\/strong> server using TTL type which is plain text to inform the rules of the domain:<\/p>\n<ul>\n<li>. \u00a0 \u00a0 \u00a0 \u00a0 IN\u00a0 \u00a0 \u00a0 \u00a0 \u00a0TXT \u00a0 \u00a0 \u00a0 \u00a0 &#8220;v=spf1 <strong>mx<\/strong>&#8221;\n<ul>\n<li>Only the IP in MX record is allowed to send emails for this domain.<\/li>\n<\/ul>\n<\/li>\n<li>. \u00a0 \u00a0 \u00a0 \u00a0 IN\u00a0 \u00a0 \u00a0 \u00a0 \u00a0TXT\u00a0 \u00a0 \u00a0 \u00a0 \u00a0&#8220;v=spf1 <strong>a<\/strong>&#8221;\n<ul>\n<li>Only IPs with an A record are allowed.<\/li>\n<\/ul>\n<\/li>\n<li>. \u00a0 \u00a0 \u00a0 \u00a0 IN \u00a0 \u00a0 \u00a0 \u00a0 TXT \u00a0 \u00a0 \u00a0 \u00a0 &#8220;v=spf1 <strong>-all<\/strong>&#8221;\n<ul>\n<li>Reject anything that does not comply.<\/li>\n<\/ul>\n<\/li>\n<li>. \u00a0 \u00a0 \u00a0 \u00a0 IN \u00a0 \u00a0 \u00a0 \u00a0 TXT \u00a0 \u00a0 \u00a0 \u00a0 &#8220;v=spf1 <strong>~all<\/strong>&#8221;\n<ul>\n<li>Accept but flag any non-compliant e-mail.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Configure Reverse DNS<\/strong> (rDNS):<\/p>\n<p>Our guides on configuring DNS and rDNS records within the Linode Manager are linked below:<\/p>\n<ul>\n<li>If your server is located in a VPS (AWS, GCP, Linone, etc) you can go into your cloud dash panel and edit the reverse DNS to your domain or sub-domain.<\/li>\n<li>If you are the owner of the server set up a local DNS Resolver. I recommend BIND9 DNS software.<\/li>\n<\/ul>\n<p>Once SFP and rDNS are complete, confirm that these records have been configured correctly by running the following commands:<\/p>\n<pre>dig +short <strong>DOMAIN.COM<\/strong>\r\ndig -x <strong>1.1.1.1<\/strong> +short<\/pre>\n<p>The first will check the SFP in DNS records.<\/p>\n<p>The second will check the rDNS.<\/p>\n<p>In my example, <strong>DOMAIN.COM<\/strong> has set SPF to <strong>1.1.1.1<\/strong>, so <strong>1.1.1.1<\/strong> should also be reversed to <strong>DOMAIN.COM<\/strong>.<\/p>\n<hr \/>\n<p><strong>DKIM (Domain Keys Identified Mail)<\/strong> is an authentication method designed to detect forged senders.<\/p>\n<p>It requires to copy\/paste the key generated by the outgoing email server to the DNS records using the TXT format. See example:<\/p>\n<ul>\n<li>Record name\n<ul>\n<li><strong>itytzkakk._domainkey.<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Value\n<ul>\n<li><strong>&#8220;v=DKIM1; k=rsa; p=4GNADCBiQKBgQCgzjLMIGfMA0GCSqGSIb3DQEBAQUAAo9D2g8sCXXcad9\/S5HAAG7m5yVMnSN5TCaYBDR30YhU\/BAG8o8B93nkMGZwe9FAaUtD+qTMDp2dByA9n1rtPvssQbXUnwgmUD20e1lKOjyi\/Yrbgr4JCNlP+7HTFviRfoMdtzfIBfK8Nkl0JeZ3GvNkQfwIDAQABRDtyuGSdFWtaS&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>DMARC (Domain-based Message Authentication, Reporting &amp; Conformance)<\/strong> it defines the policy to be applied when SPF and\/or DKIM fail.<\/p>\n<p>It also requires a DNS record using the TXT format. See example:<\/p>\n<ul>\n<li>Record name\n<ul>\n<li><strong>_dmarc.<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Value\n<ul>\n<li><strong>&#8220;v=DMARC1; p=reject; fo=1; pct=100&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Description of the syntax:<\/p>\n<ul>\n<li><strong>v DMARC1<\/strong>\n<ul>\n<li>DMARC protocol version.<\/li>\n<\/ul>\n<\/li>\n<li><strong>p reject<\/strong>\n<ul>\n<li>Apply this policy &#8216;none&#8217;, &#8216;quarantine&#8217;, or &#8216;reject&#8217;.<\/li>\n<\/ul>\n<\/li>\n<li><strong><span style=\"color: #777777; font-size: 1rem;\">pct 100<\/span><\/strong>\n<ul>\n<li><span style=\"color: #777777; font-size: 1rem;\">The percentage tag instructs the percentage of email the policy must be applied.<\/span><\/li>\n<\/ul>\n<\/li>\n<li><strong><span style=\"color: #777777; font-size: 1rem;\">fo 1<\/span><\/strong>\n<ul>\n<li><span style=\"color: #777777; font-size: 1rem;\"> Forensic options &#8216;0&#8217; to generate reports if both DKIM and SPF fail or &#8216;1&#8217; to generate reports if either DKIM or SPF fails.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>WEB TOOLS<\/strong><\/p>\n<ul>\n<li>LearnDmarc [<a href=\"https:\/\/www.learndmarc.com\/\">Link<\/a>]<\/li>\n<li>easySPF Wizard [<a href=\"https:\/\/www.spfwizard.com\/\">Link<\/a>].<\/li>\n<li>DMARCreport [<a href=\"https:\/\/app.dmarcreport.com\/\">Link<\/a>].<\/li>\n<li>ValiMail [<a href=\"https:\/\/domain-checker.valimail.com\/dmarc\">Link<\/a>].<\/li>\n<li>PowerDMARC [<a href=\"https:\/\/powerdmarc.com\/analyzer\/\">Link<\/a>].<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Tools against SPAM and domain spoofing: SPF &#8211; Whitelist of hosts that are allowed to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-442","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=442"}],"version-history":[{"count":9,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/442\/revisions"}],"predecessor-version":[{"id":3910,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/442\/revisions\/3910"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}