DKIM (Thank u to the team !) but DMARC ?
- Thread starter atec666
- Start date
DKIM is signing messages, SPF is providing a list of "allowed" mail servers to send mails on your domains behalf. DMARC helps you to enforce your settings by getting informed on any misuse and providing guidance on how to handle mails with invalid/missing DKIM signature and violating your SPF policy.
If your messages get blocked by Google and Microsoft, you may check, if your SPF policy is correct (may be the primary problem) or if you have issues with your DKIM signing. There are tools to check SPF, DKIM and DMARC as well. There are also recipient boxes to validate, if your settings look valid. Final checkpoint is using this: https://www.sparkpost.com/email-tools/authentication-checker/
If your messages get blocked by Google and Microsoft, you may check, if your SPF policy is correct (may be the primary problem) or if you have issues with your DKIM signing. There are tools to check SPF, DKIM and DMARC as well. There are also recipient boxes to validate, if your settings look valid. Final checkpoint is using this: https://www.sparkpost.com/email-tools/authentication-checker/
ehlo,
Everything seems to working fine with spf, dkim (now in PMG : GOOd !) ... but no DMARC in PMG WebGui ... i put it on my DNS record : and it seems to be ok.
The question is : must i do something in PMG for DMARC (apt install opendmarc etc) ? (i think no because when testing with this tool : everything seem toi be fine)
Is it for beoing sure. ;-)
For outgoing mails you don’t need to do anything extra, DMARC is a DNS thing, so Proxmox can’t add to the GUI (beside maybe an explanation what to do, but that’s somehow overkill). For inside checking DMARC is somehow implemented in SpamAsssassin by checking for SPF and DKIM. If you also want your postfix to check and directly react on DMARC you may install and configure (manually, your way) opendmarc or you may open a feature request for Proxmox to add to PMG. Somehow same as SPF, I myself won’t use that module because of too much possible false positives because of worse administered SPF records and many issues with DKIM (nice but useless).
DKIM is broken by design, SPF as well. SRS is not always implemented, ARC (to fix problems with DMARC) is much less implemented.
I can send mails to Google Mail Abuse address about all the well SPF approved and DKIM signed DMARC valid spam I get from them without using SPF and DKIM or DMARC on my corporate accounts (it's just enabled as well as DANE on my private playground). ^^