Comment by brightball | Hacker News Reader

Comment by brightball | Hacker News Reader

Parent Full thread

Sure!

First off, no you are not hurting yourself. If anything, you're helping because you're making it harder for your domain to be flagged by spam filters for things you haven't done.

Here's a quick explanation of SPF, DKIM and DMARC.

SPF

- It's a simple record in your DNS that let's you list IP addresses authorized to send email from your domain. 3rd party senders will often ask you to include them in your spf record. With nothing in the record and the "-all" meaning strictly enforced, you've not authorized any senders at all with SPF.

DKIM

- DKIM has to be setup for every sending mail server with a configuration mapped to a key located in your DNS config. If a receiving mail server gets a message without a DKIM signature, it has no way of knowing it should be there.

DMARC

- When you enforce a dmarc policy, you tell a server that receives email saying it is from your domain to only accept it if the message passes either an SPF or DKIM check that "aligns" with the domain. It's possible to send a message saying it's from slimmeryetimbers.com with a DKIM check that passes for "myphishdomain.com" and DMARC will not accept it.

So has to be from one of your allowed IP addresses in the SPF record or must include a DKIM signature from your specific domain. With SPF essentially empty of options, this will mean that an aligned DKIM signature must present the for it to pass.

The dmarc policy is the "p=". A "p=none" is just for show. Doesn't enforce anything. "p=quarantine" asks the receiving mail server to put messages that fail into spam while "p=reject" tells it to not deliver them at all.

-------

So summarizing all of that...the SPF record above says that no IP addresses are allowed to send mail on your behalf and the DMARC record tells the receiving mail server not to allow any messages saying they are from your domain unless they pass the SPF check (which they can't, because nothing is allowed) or they pass the DKIM check (which they can't, because you haven't set any up).

Hope that helps and I'm happy to clarify anything that needs it.

Thank you for this answer!

A few more questions:

1. Would there be any issues receiving emails with these policies set?

2. Quoting OP's edit:

> Edit: Also, if I have a domain that currently does not send email but may in the future, am I hurting my future self by setting any of these?

None. SPF, DKIM and DMARC only affect outgoing mail.

Incoming mail is handled entirely by your mail server which is pointed to by your MX record.

This is actually where a lot of the confusion comes from. When you buy a domain, it doesn't go anywhere until you point it to specific web servers by adding A or CNAME records in your DNS. Same thing with your incoming email, nobody knows where to send a message until you setup your MX records. You can setup a web server that will serve any domain you want, but until the DNS points to it there's not an easy way for people to find it.

Outgoing mail had no such check though. Any server could send a message claiming it was from your domain unless you took the time to specify where your mail is coming from.

And no, this won't hurt you at all. All it does is tell the receiving mail servers that for an email from the domain to be valid, it must pass a DMARC check. If you subsequently setup something like Google for your domain's email, you'd just update the record by following the instructions Google will give you. For example:

"v=spf1 include:_spf.google.com ~all"

This let's Google manage the set of IP addresses. Google will likely also give you instructions to setup DKIM by adding a couple of additional records. This will ensure anything sent by Google for you domain will pass both SPF and DKIM, allowing it to be properly validated and delivered.

You'll notice that "~all" instead of "-all" as well. When you're actually sending email from the domain, it's best to use "~all" instead of "-all". The "-all" can sometimes be over zealously strict and by using "~all" instead it will be enforced but let you defer to the DMARC policy for the enforcement of failures (such as forwarding or list serves that DKIM would still survive but SPF wouldn't).

> nobody knows where to send a message until you setup your MX records

Not quite. RFC 974 says It is possible that the list of MXs in the response to the query will be empty. This is a special case. If the list is empty, mailers should treat it as if it contained one RR, an MX RR with a preference value of 0, and a host name of REMOTE. (I.e., REMOTE is its only MX). In addition, the mailer should do no further processing on the list, but should attempt to deliver the message to REMOTE.

Reply on news.ycombinator.com