TXT record for SPF needed?

kylotan

This was a header seen on an autoresponse sent from an Opalstack email address. The autoresponse would sometimes go into Junk when received by an Outlook.com mailbox even before the SPF record, and it was this I was hoping to avoid - but adding the record changes it from Neutral to a Softfail.

EDIT: Okay, further testing seems to indicate that the problem is thankfully limited to the autoresponder, which is sending from 91.109.16.70 in my case (imap1.de.opalstack.com). I'm changing the record to the following in the hope it will fix it:

v=spf1 include:spf.opalstack.com include:mail.de.opalstack.com ~all

sean

kylotan include:mail.de.opalstack.com is not going to work.

If you want to include the IP of the DE IMAP server then please use ip4:91.109.16.70.

lademo

My emails now have SPF, DKIM, and DMARC working. For DMARC, I followed the instructions from Sean above, but DMARC Analyzer complained that the domain should be _dmarc.mydomain ... so I created a subdomain _dmarc, and used that in the TXT record and now it works. I hope that was the right thing to do, and maybe it helps someone else.

sean

lademo That was the right thing to do! I've updated my answer above to include the _dmarc subdomain.

psykhe

I'm a bit lost about these instructions and the ones in https://docs.opalstack.com/user-guide/domains/#records-for-your-email.
The instructions in the user-guide let it appear as if there is a "Host" field in the "Add DNS Record" pop-up window, but there isn't. So now I understand that I should create 2 subdomains (it would be good maybe to put that in the user-guide). What I'm not clear about is, should the DKIM txt record be added to the DKIM subdomain and the same for the DMARC record? Or should these TXT records be added to the <domain.com>?

Your help is greatly appreciated.

johns

Create a domain object for the host. Host is what most other platforms call this record, here we unify it with the domain object.

psykhe

Okay, as I said in my previous message, I understand now that I need to create 2 subdomains. My question was, where should the DKIM and the DMARC TXT records go? In the just created subdomains, or in the main domain?

johns

DKIM is on the base domain, SPF is assigned to the base domain. DMARC would go on the specially created domain.

bici

sean

so does one also have to add the SPF text record to the Domain : _dmarc.mysite.com

I had the domain mysite.com where i had added the SPF record. But now i see that we should use a dmarc subdomain for adding DMARC text records.

Just wondering if i have done the procedure correctly.
Happy Winter Solstice

sean

bici so does one also have to add the SPF text record to the Domain : _dmarc.mysite.com

First you create the domain "_dmarc.mysite.com" as a new domain in your Opalstack dashboard, then you add the TXT record to that.

That said, there's no reason to add a SPF record to your DMARC subdomain. The only record you need there is the DMARC TXT record.

bici

sean
how do we resolve this Dmarc Policy Not Enabled issue:

More Information About Dmarc Policy Not Enabled
This Warning indicates that the DMARC record for this domain is not currently protected against phishing and spoofing threats. To resolve this Warning you will need to set a Quarantine or Reject policy on the domain's DMARC record. Setting a Quarantine or Reject value will prevent fraudsters from spoofing the domain as mail servers will Quarantine or Reject messages that fail authentication tests.

sean

bici it seems like the tool you're using doesn't recognize "none" as a valid DMARC policy, so you'll need to use "quarantine" or "reject" instead.

"quarantine" tells the receiving server to send the message to spam when it doesn't pass the DMARC check and "reject" tells the server to reject the message.

To set up a full-featured DMARC record with reporting etc and you're not sure of the syntax then I recommend using a tool like the DMARC Record Wizard.

bici

sean
i used https://mxtoolbox.com/DMARC.aspx to check. Perhaps I won't worry about changing anything as the other checks all passed. Is there another tool i can use to verify dmarc?

sean

bici sure, there are many! https://duckduckgo.com/?q=dmarc+record+checker

bici

sean
ok thanks. Mimecast suggested a dmarc record of:

v=DMARC1; p=none; rua=mailto:email@yourdomain.com; ruf=mailto:email@yourdomain.com; fo=1;

Seems overkill. I'll stay with what Opalstack suggests.

sean

bici we'll expand the documentation in the future to include some other examples. What's there right now isn't really a recommendation, more like "I have to get a valid DMARC example into the docs and I don't have much time" 😀