TXT record for SPF needed?

ngkabra

If I have a domain whose nameservers are pointed at opalstack nameservers, and I have an email address for that domain configured on opalstack using opalstacks SMTP servers to send outgoing mail.

Should be I manually create the TXT records in my DNS to improve the chances of my emails not getting marked as spam? Or is this automatically handled somehow?

If yes, is this the correct value:

v=spf1 include:spf.opalstack.com ~all

sean

ngkabra Correct, as documented: https://help.opalstack.com/article/109/how-do-i-make-a-spf-record-for-opalstack-email

You can also make a DMARC record which should improve deliverability a bit more - create a new TXT record with the following values:

Domain: _dmarc.domain.com (create this first)
Type: TXT
Content: v=DMARC1; p=none
Everything else: defaults

bici

sean

so does one also have to add the SPF text record to the Domain : _dmarc.mysite.com

I had the domain mysite.com where i had added the SPF record. But now i see that we should use a dmarc subdomain for adding DMARC text records.

Just wondering if i have done the procedure correctly.
Happy Winter Solstice

ngkabra

Thanks. I've now set SPF and DMARC records.

But now I'm wondering: Should I be setting up a DKIM record also?

sean

ngkabra We generate DKIM for your domain and sign your outgoing messages automatically.

You can view your DKIM record by clicking the key icon for whatever domain at https://my.opalstack.com/domains/

kylotan

A couple of comments:

1) Is there any reason we can't have these SPF and DMARC records auto-generated with sensible defaults? e.g. if I add an email address x@y.com then it could add the default TXT records for y.com if they don't already exist (and if no other v=DMARC1 or v=spf record exists already)

2) When adding multiple entries via the blue button on the "New DNS Record" page, the defaults aren't pre-populated. It would be great if they could be pre-populated - and perhaps another good idea would be to have a button to 'Duplicate Record' which copies all the fields from the record above, so we'd only have to change the domain (for example).

kylotan

Okay, another follow-up - I think there's a problem with the SPF instructions.

Before I had the SPF record in DNS, auto-responses from an OpalStack email going to Gmail had this in the headers:

Received-SPF: neutral (google.com: 91.109.16.70 is neither permitted nor denied by best guess record for domain of <address removed by me>) client-ip=91.109.16.70;

And after following the instructions to add v=spf1 include:spf.opalstack.com ~all, it is now this:

Received-SPF: softfail (google.com: domain of transitioning <address removed by me> does not designate 91.109.16.70 as permitted sender) client-ip=91.109.16.70;

This seems to be worse! I note that spf.opalstack.com is at 46.165.236.26, rather than 91.109.16.70.

sean

kylotan our SPF instructions are fine for people who need to send and receive email via Opalstack's mail system.

Regarding the headers you mentioned, did those messages land in your spam folder?

We'll look into SPF and DMARC by default.

kylotan

This was a header seen on an autoresponse sent from an Opalstack email address. The autoresponse would sometimes go into Junk when received by an Outlook.com mailbox even before the SPF record, and it was this I was hoping to avoid - but adding the record changes it from Neutral to a Softfail.

EDIT: Okay, further testing seems to indicate that the problem is thankfully limited to the autoresponder, which is sending from 91.109.16.70 in my case (imap1.de.opalstack.com). I'm changing the record to the following in the hope it will fix it:

v=spf1 include:spf.opalstack.com include:mail.de.opalstack.com ~all

sean

kylotan include:mail.de.opalstack.com is not going to work.

If you want to include the IP of the DE IMAP server then please use ip4:91.109.16.70.

lademo

My emails now have SPF, DKIM, and DMARC working. For DMARC, I followed the instructions from Sean above, but DMARC Analyzer complained that the domain should be _dmarc.mydomain ... so I created a subdomain _dmarc, and used that in the TXT record and now it works. I hope that was the right thing to do, and maybe it helps someone else.

sean

lademo That was the right thing to do! I've updated my answer above to include the _dmarc subdomain.

psykhe

I'm a bit lost about these instructions and the ones in https://docs.opalstack.com/user-guide/domains/#records-for-your-email.
The instructions in the user-guide let it appear as if there is a "Host" field in the "Add DNS Record" pop-up window, but there isn't. So now I understand that I should create 2 subdomains (it would be good maybe to put that in the user-guide). What I'm not clear about is, should the DKIM txt record be added to the DKIM subdomain and the same for the DMARC record? Or should these TXT records be added to the <domain.com>?

Your help is greatly appreciated.

johns

Create a domain object for the host. Host is what most other platforms call this record, here we unify it with the domain object.

psykhe

Okay, as I said in my previous message, I understand now that I need to create 2 subdomains. My question was, where should the DKIM and the DMARC TXT records go? In the just created subdomains, or in the main domain?

johns

DKIM is on the base domain, SPF is assigned to the base domain. DMARC would go on the specially created domain.

sean

bici so does one also have to add the SPF text record to the Domain : _dmarc.mysite.com

First you create the domain "_dmarc.mysite.com" as a new domain in your Opalstack dashboard, then you add the TXT record to that.

That said, there's no reason to add a SPF record to your DMARC subdomain. The only record you need there is the DMARC TXT record.

bici

sean
how do we resolve this Dmarc Policy Not Enabled issue:

More Information About Dmarc Policy Not Enabled
This Warning indicates that the DMARC record for this domain is not currently protected against phishing and spoofing threats. To resolve this Warning you will need to set a Quarantine or Reject policy on the domain's DMARC record. Setting a Quarantine or Reject value will prevent fraudsters from spoofing the domain as mail servers will Quarantine or Reject messages that fail authentication tests.

sean

bici it seems like the tool you're using doesn't recognize "none" as a valid DMARC policy, so you'll need to use "quarantine" or "reject" instead.

"quarantine" tells the receiving server to send the message to spam when it doesn't pass the DMARC check and "reject" tells the server to reject the message.

To set up a full-featured DMARC record with reporting etc and you're not sure of the syntax then I recommend using a tool like the DMARC Record Wizard.

bici

sean
i used https://mxtoolbox.com/DMARC.aspx to check. Perhaps I won't worry about changing anything as the other checks all passed. Is there another tool i can use to verify dmarc?

sean

bici sure, there are many! https://duckduckgo.com/?q=dmarc+record+checker