Stefan ten Hoeve | 1 | 0 | Blog, Mail

How to setup SPF, DMARC and DKIM for Exchange.

Since years there are some extra “settings” you can set to make sure your email does not get tagged as SPAM, as the other party can check if the email comes from a legitimate source.

There are some things you can do to make sure your email does not get tagged as SPAM:

• Do not get blacklisted.
• Make sure your server is not an open relay.
• Setup an Sender Policy Framwork (SPF)
• Setup a Domain-based Message Authentication, Reporting and Conformance (DMARC) policy
• Setup DomainKeys Identified Email

In the coming blogs I will write about how to setup SPF, DKIM and DMARC for an exchange system.

(SPF) Sender Policy Framework.

The Sender Policy Framework is published in 2006 by the IETF and made a standard in 2014. Originally called Sender Permitted From. The framework is setup to minimize the amount of spam coming in. In the SPF record you create you let the receiver end know from which ip-address or range of ip-adresses email sent by your organization can originate from. If the sending host is not in the SPF record, receiving mailservers can block the mail completely or mark it as spam.

An SPF record is setup in your DNS. It’s a TXT record.

There are lots of sites on the internet that test your spf record, lets have a look at our (Netflex.nl) SPF record:

(From http://mxtoolbox.com/spf.aspx)

The first part of the spf record indicates the version of SPF: spf1

Then there are some includes, these are the domains that are searched for an allow when an email is accepted by a foreign server. The last option is -all, ?all or ~all depending if the email should:

Pass (+all)

Fail (-all)

SoftFail (~all)

Neutral (?all)

Our spf record is pretty strict and fails every email that does not fall in any of the includes. If you set up a spf record for the first time and do not know if every domain is accounted for in the spf record, you can set the qualifier to a setting that is less strict.

One of the best ways to create a good spf record for your environment is to check which sites sent mail for your domain, and then use a spf calculator, like the one on www.spfwizard.net

When you have created a well-defined spf record, go to your hosting provider and create a TXT record on their server with the appropriate settings.

To test your spf record you can use:

http://www.kitterman.com/spf/validate.html

I will discuss DKIM in my next blog.