Post #1896124

2024-12-15 13:46 UTC

DMARC record that tells the receiving email server how to handle email that fails either check. Could be that I misunderstood you, but: It tells what to do if no mechanism (DKIM or SPF) results in a pass. DMARC actually only requires one mechanism to pass. So an email with a DKIM fail, but an SPF pass is considered OK. And vice-versa. Edit: good advice by the way regarding protecting your domain reputation, I’ll check our non-email domains at work first thing tomorrow.

Replies (2)

@Jerry@hear-me.social 2024-12-15 19:26

@Aganim I'm not an expert on this (it's a career), but I know it's not that simple. If I get an unforwarded email, I definitely want both DKIM and SPF to pass. I want only email from an authorized server, and I want an email that is not modified and is properly signed. No exceptions. Both must pass. If I get email from a mailing list that is sending email to me on behalf of a different domain, I want SPF to pass in that I want to know that the mailing list provider's server is authorized to send email on behalf of the original domain. But, in this case, the original DKIM will fail because the mailing list provider will have changed the email. But, I expect the new DKIM to be correct, or I won't accept it. So, here, a failure on the original DKIM can be acceptable. If someone forwards an email to me, the original DKIM will fail. I will accept it. But, I want the SPF of the forwarding server to pass, and the new DKIM for the changed email to pass. There's also email redirection and forwards that happen at the server vs. the client and there can be separate rules for this. The records can get complicated if you truly want to control different scenarios. But, you don't always want to accept an email if only 1 check passes. At least, this is my understading of it all.

Open ##1896125
@colin@mastodon.colincogle.name 2024-12-16 02:00

@Aganim @Jerry Correct. DMARC alignment only requires a single thing to pass. A forwarded email or newsletter might fail SPF but pass DKIM, and that’s acceptable. #DMARC

Open ##1896127