Score:0

SPF/DKIM setup for a registrar's email forward

de flag

I have a number of domains with a registrar with straight forward forwards to another email address.

The system has worked flawlessly for a lot of years over a lot of domains but recently I created a new forward which failed on testing.

The error was not a SPF/DKIM error it was an address unknown error. The registrar insists the reason for failure is their system does not allow spf and dkim records to exist on the domain to be forwarded.

My knowledge in the area is not extensive but I am not convinced the statements by the registrar are true. Any guidance out there?

Nikita Kipriyanov avatar
za flag
Can you attach an error mesage to the question, please? You can mask sensetive parts (addresses and names).
Kevin_Wales avatar
de flag
Thanks for your help - Remote Server returned '554 5.0.0 <****.*****.*** #5.0.0 smtp; 550 Unrouteable address>'
Nikita Kipriyanov avatar
za flag
This looks more likely that MX query wasn't answered timely.
Kevin_Wales avatar
de flag
I think I should manually add the forwarder's relay ip address or they create the correct records for their forwards and I add this to the spf/ dkim records. However the error message does not support the need for this. I am not happy with their responses, I think there is a fault on their forwarder IMHO. But as I said I am not in any way an expert in SPF/DKIM.
Nikita Kipriyanov avatar
za flag
Why are you using them?
Kevin_Wales avatar
de flag
Up until this week we had no issues. However I am thinking of moving but we have a lot of domains with them.
Score:0
za flag

No, DKIM and SPF don't disable mail relaying entirely. Instead, they only allow authorized relays to relay mail for a domain, and recommend that all receiving systems reject mail from unauthorized relays. This authorization is announced via special DNS records.

It is possible to setup several outbound relays (your own server and some external servers) at the same time. But you'll end up with listing them all in your SPF and DKIM records.

For SPF, you must either know all of relay IP addresses, or a name of their SPF valid record which lists all their addresses. You then set up into your SPF record all of those addresses, or use include:their-spf-record, in addition to your own or other relays you need:

example.com. TXT "v=spf1 a:your.server.name include:their-spf-record ip4:192.0.2.111 -all"

(there may be many different a:, include:, ip4: parts).

For DKIM, relay operator must generate signing key pairs. Then they must tell you the public key and its selector (they also configure their server to sign using corresponding private key and this selector). Then for each key-selector pair you create additional TXT record of the form:

selector._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=..<key>.."

Of course, each system must use its own distinct selector.

This is all DNS setup needed to send mail with "from" domain from several systems simultaneously.


The SPF part shouldn't have any difficulty for anybody. The problem with their system might be they don't know how to set up DKIM signing for relayed mail. In my case, for example, postfix+rmilter does this and it has no problems, all can be configured. Also you can choose to sign with DKIM on your server which uses the relay as the smarthost, and you have to assure relay systems don't mess with signed headers and don't remove your signature; if so, there is no need to setup additional DKIM signing on relay system.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.