Jump to content

This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!

DKIM: Difference between revisions

1,961 bytes added ,  2 September 2021
m
(26 intermediate revisions by the same user not shown)
<indicator name="Faults">[[File:Menu-email.svg|link=:Category:Email|30px|Back up to the Email Category]]</indicator>
 
Support staff can help in adding DKIM signing for domains we host.
 
== Important: ==
'''Currently being trialled by staff, not available to customers'''
As with SPF, if you use DKIM/DMARC then you will also want to make sure that all email that you send from your domain is sent through email servers that will sign
your messages - ie, all your outbound email should be sent out through smtp.aa.net.uk.
 
When using DKIM or SPF, you need to be careful that all you other devices, servers or services that send email from your domain all send through a server that will sign your messages.
 
== What is DKIM? ==
 
This is just a brief overview of DKIM, you can read more about DKIM on other place or RFC6376
 
Also see [[SPF Record]]
 
DKIM is one of many methods which tries to protect email senders and recipients from spoofing/spam. Aand domainto ownerproove canthat addan DNSemail recordshasn't whichbeen publishtampered a public key in a specially formattedwith.
 
TXT record. The email server they use for sending email (eg smtp.aa.net.uk) holds the private key and will sign messages and add this signature to the headers of the email.
A domain owner can add DNS records which will publish a public key in a specially formatted
TXT record. The email server they use for sending email (eg smtp.aa.net.uk) holds the matching private key, and will sign messages and add this signature to the headers of the email.
will sign messages and add this signature to the headers of the email. The record can either be a TXT record
or a CNAME pointing to a KEY in you email provider's DNS.
 
Other mail servers which receive the email can then inspect the DNS record and the headers to check if it all matches up.
If it does match up, then that means that the email has been sent through a server that is controlled by the domain owner.
This gives some level of confidence that the email was actually sent by the owner of the domain and not spoofed.
 
Optionally, further DNS records (DMARC) can be added which declare to these other email servers receiving the message what should be done with messagesit thatit failfails the DKIM test - eg, do notingnothing, block or quarantine.
 
Even if messages are just signed, then this can help them not to be marked as spam by the recipient. This can help prevent messages that our customers send to gmail/outlook being put in to spam folders.
 
====Long txt records?====
If you are adding your own txt records and they are over 256 characters long, see [[Domains:DNS_Types]] for details on how to 'split' the record in to separate chunks.
 
== Signing by smtp.aa.net.uk ==
 
Customers who meet the following criteria can have their messages signed by our smtp.aa.net.uk email relay:
The A&A email relays, smtp.aa.net.uk, can optionally DKIM sign email that is sent through it.
* We provide DNS services for the Domain
* The three CNAME records below are added (via the control pages)
* You use smtp.aa.net.uk to send out email
 
The DNS records required on the customer domain are as follows;
We use a single public key, and aaisp as the Selector.
 
aaisp1._domainkey CNAME aaisp1.dkim.aa.net.uk
Here is an example of what DNS record to add:
aaisp2._domainkey CNAME aaisp2.dkim.aa.net.uk
aaisp3._domainkey CNAME aaisp3.dkim.aa.net.uk
 
We have three selectors which enable us to roll over the keys easily.
Host/name: aaisp._domainkey
Type: TXT
Value: "v=DKIM1; t=y; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuloXhiatbx0YnrKgS+UL4tZrxcm1rdIxYqWDrs4aMrsFLM4IiSov0McwnFKFCXmo2zqh06OwcRwyMHe4pM+izxUnsMWCRs8BcaAuBhUM+Vbo6qwp5fWjtswaIgwVgJKwY610wg+qfuKM6o2qKc/Hy9Tj" "H5W8D64cSQ7jPCS5xu8CM4Ty/WG1Q7+cLKD1Y3stusqFEX0RFVkcSsvzHNggbDBlWAQCnGeG2+pOoAnfDqSvFvqASCOdjE9HbOZLcFnQRBDiPhegN3BYNWe6leC3SpjI67JNlhcOXAN2sT9m6bTpVFgQHLCnIY4L6TZx/mbpM0xF59kS9VPpYOtl6nQZCQIDAQAB"
 
== What if I send email via other mail servers ==
Messages will then be signed by the AAISP key.
If you use smtp.aa.net.uk and other email relays, then you will need to set up domainkey records for those mail servers too. They will use a different Selector and a different Key.
 
== Testing isthe signing_domainkey is workingDNS records==
 
dig +short aaisp1._domainkey.YOURDOMAIN TXT
dig +short aaisp2._domainkey.YOURDOMAIN TXT
dig +short aaisp3._domainkey.YOURDOMAIN TXT
 
eg,:
dig +short aaisp1._domainkey.testing.me.uk TXT
 
It should give an answer starting v=DKIM1; if no answer, then it isn't working...
 
Also try an online tool such as https://mxtoolbox.com/dkim.aspx (there are many others!)
 
== Testing if signing is working ==
 
There are various ways to test if signing is happening.
 
'''Send yourself an email'''
If you send yourself an email, look at the header and you should see a DKIM-Signature: header which will include the signature along with s=aaispaaisp1 which is the 'Selector we use'.
 
'''Send to a gmail account and check the DKIM report'''
=DMARC=
 
This is just a brief overview of DMARC, you can read more about DKIM on other place or RFC7489
Adding a DMARC DNS record is optional, but can be beneficial. If you add DMARC records then you also need to make sure that
 
Adding a DMARC DNS record is optional, but can be beneficial. If you add DMARC records then you also need to make sure that
 
If you add DMARC records then you also need to make sure that
all the email you send is being sent through smtp relays which will sign your messages. ie, '''all your email for your domain would want to be
sent through smtp.net.uk'''
 
There are various online generators for creating a dmarc record, but the contents of the record will cover the following basic settings:
* 'v' - The version - usually DMARC1
* 'p' - What to happen if dmarc fails, eg none, quarantine, reject
* 'rua' - an email address (or multiple comma separated addresses) of where you'd like to XML receive machine readable statistic reports
* 'ruf' - an email address (or multiple comma separated addresses) where you'd line to receive individual failure'forensic' reports, these are XML machine readable copes of email that failed
 
There are more options available beyond the ones above.
 
The rua and ruf will be used by some of the bigger email providers - eg gmail, outlook, yahoo.
We'd suggest initially setting up reporting but no rejecting so that you can see how it's working out.
 
AndAn example dmarc record which would send you reports but not tell other email severs to block if a message fails DKIM would look like this:
 
Host: _dmarc
autoreview, Bureaucrats, editor, Interface administrators, reviewer, Administrators
12,264

edits