I'm trying to enter a 4028 bit DKIM key into DNS and it seems that I'm exceeding both the UDP 512 byte limit and also the maximum record size for a TXT record.
How does someone properly create a large key (with implied larger encoded size) and import it into DNS?
I configured hardfail SPF for my domain and DKIM message signing on my SMTP server. Since this is the only SMTP server that should be used for outgoing mail from my domain, I didn't foresee any complications.
However, consider the following situation: I sent an e-mail message via my SMTP server to my colleague's university e-mail. The problem is that my colleague forwards his university e-mail to his GMail account. These are the headers of the message after it reaches his GMail mailbox:
Received-SPF: fail (google.com: domain of [email protected] does not designate 192.168.128.100 as permitted sender) client-ip=192.168.128.100; Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 192.168.128.100 as permitted sender) [email protected]; dkim=hardfail (test mode) [email protected]
(Headers have been sanitized to protect the domains and IP addresses of the non-Google parties)
GMail checks the last SMTP server in the delivery chain against my SPF and DKIM records (rightfully so). Since the last STMP server in the delivery chain was the university's server and not my server, the check results in an SPF hardfail and DKIM failure. Fortunately, GMail did not mark the message as spam but I'm concerned that this might cause a problem in the future.
Is my implementation of SPF hardfail perhaps too strict? Any other recommendations or potential issues that I should be aware of? Or maybe there is a more ideal configuration for the university's e-mail forwarding procedure? I know that the forwarding server could possibly change the envelope sender but I see that getting messy.
I've configured DKIM (milter-dkim) on my mail server. Incoming e-mail sent from my domain now containts the following header:
X-DKIM: Sendmail DKIM Filter v2.8.3 MYDOMAIN.com o7FLH1Wa032083
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=mydomain.com; s=mail;
t=1281907022; bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;
h=Message-ID:Date:Subject:From:To:MIME-Version:Content-Type:
Content-Transfer-Encoding;
b=qetPkilXBdjnuqiKIyvAwsvTvJfAnq5urdgp/i7p/uLJ8DB+svy9A8C6CPmcfELsJ
hDid5k2AN5JD+wM2INmUIgjeAa/IwpGTbuMloj0Wioh4njqIfbATJqOhuqxTjic
1.) So I guess that confirms that I have DKIM setup correctly, right?
But when I look at a message coming in from Google, I see:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
...snip...
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
...snip...
2.) What is the relationship of DomainKey-Signature vs DKIM-Signature?
Having read Jeff's blog post about Email and DKIM, I'm thinking it might be good to DKIM all mail coming out of our Exchange 2003 servers. Whats a good way of going about that?
I am creating a server with a primary nameserver and mutliple domains. Do i need to make TXT records for all the domain, they all have there own email, but use the mailserver from the primary.
EDIT:
I am currently on a server running CentOS and Plesk. One option i can choose is to use Domain Keys"
If i enable the domain keys, there are 2 TXT fields created, one with a long key, and one with a o=- value.
If I enable this do i still need to have the SPF records, or is this inferior to the SPF records, in terms of SPAM.