DKIM Works Fine But Should I Use It For Incoming?

5 posts / 0 new

Topic locked

#1 Thu, 02/27/2014 - 08:44

webwzrd

DKIM Works Fine But Should I Use It For Incoming?

I decided to give DKIM another try last week. Unlike the first time I tried to use it a while back, it was completely effortless to enable and it seems to be working great.

However the question is it really ready for prime time to be checking/rejecting incoming email with it? I'm starting to get complaints from clients that a small number of people sending them mail are getting bounce back and the logs clearly show they didn't pass the DKIM check.

What's the general consensus here, try to educate my clients to pass on the word for everyone to use DKIM or disable incoming checks?

#2 Thu, 02/27/2014 - 12:47

lp86

I have also experimented with using DKIM for some of my domains. My theory for both DKIM and SPF is, if you have enabled it, but something isn't configured correctly, then your mail should be bounced. Also a big issue with both DKIM and SPF is making sure you have everything covered as far as signing all mail for the domain, and making sure you know where mail is coming from for the domain.

Of the two, I prefer to use SPF, as it is the most effective. Once I am 100% sure I have configured the record to encompass all senders, then I set it from Neutral (?) to Fail (-)

#3 Thu, 02/27/2014 - 13:06 (Reply to #2)

webwzrd

I have every reason to believe DKIM is working perfectly. It just appears that too many other mail servers aren't using DKIM signing, so I'm rejecting valid email as well as spam.

It's looking like it's not a good idea to have "Reject incoming email with invalid DKIM signature?" set to yes, so I have now disabled it.

However the default was set to "Yes", which I took as the suggested preference. I'm thinking now the default should probably be "No".

Brian

#4 Thu, 02/27/2014 - 13:15

lp86

If you have DKIM or SPF setup incorrectly, your mail should be bounced. There is no excuse to have broken DKIM/SPF running.

That setting only rejects mail with a invalid signature, it doesn't reject mail without DKIM. Yes is a good default.

#5 Thu, 02/27/2014 - 13:46 (Reply to #4)

webwzrd

Ahhh, well that changes everything than doesn't it.

What does it mean when the reject notice reads:

Feb 23 13:10:13 secure postfix/cleanup[23508]: 5AEAD1528D91: milter-reject: END-OF-MESSAGE from cp3.worldpath.net[64.140.224.214]: 4.7.1 Service unavailable - try again later;

Topic locked