Looking for help implementing email standards on our server.
We have been using SPF but need help with
Here's a guide to the key email authentication standards:
DKIM
DMARC
Reverse DNS
cheers
Naylin
Looking for help implementing email standards on our server.
We have been using SPF but need help with
Here's a guide to the key email authentication standards:
DKIM
DMARC
Reverse DNS
cheers
Naylin
![]() ![]() |
Reverse DNS is something you need to organise with your service provider, and not the configuration of the server.
If you have a Linux server, there are guides on the Internet on how to set them up. You will need to be able to make changes to your DNS records for DKIM to work correctly.
What email software is the server running?
Backblaze cloud backup (personal and business) | Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) |
My technology disclosure | Business Transformation | Enterprise Content Management | Customer Relationship Management | Sharesies investment fund
Naylz:
Looking for help implementing email standards on our server.
We have been using SPF but need help with
Here's a guide to the key email authentication standards:
DKIM
DMARC
Reverse DNS
cheers
Naylin
Who does your DNS? If you could let us know the domain we can view the public records and offer some suggestions.
This is a good blow by blow for dkim https://www.mailjet.com/blog/news/setting-up-dkim-step-by-step-a7d0a0ec-c4aa-4b5b-aeb5-a06361aa2e51/
i used this for dmarc: https://blog.returnpath.com/build-your-dmarc-record-in-15-minutes-v2/
SPF - Thi sis a good wizard for those: https://www.spfwizard.net/
All the above require you to set up txt DNS records in your provider.
That first article links to a DKIM software that doesn't exist anymore and you'd have to generate your keys to use it anyway.
If you running your own serever there are other software available. I use ThinkDKIM on my Windows SMTP server - it creates the keys, allows you to have multiple key pairs and guides you on configuring DNS changes. I also use Office 365 and have DKIM configured on that, with a different key pair and selector group.
If you are using Google or Office 365 both support DKIM by just checking a box and give you instruction to create the DNS entries.
You then create DMARC records to values that match your configuration settings. DMARC Analyzer does a good job of helping here.
Backblaze cloud backup (personal and business) | Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) |
My technology disclosure | Business Transformation | Enterprise Content Management | Customer Relationship Management | Sharesies investment fund
I've done all that on Google for Business, but not on a standalone email server. Have you consider hosted email? Email is a commodity service these days, pay someone else to do it unless you have a good reason to host your own.
AWS Certified Solution Architect Professional, Sysop Administrator Associate, and Developer Associate
TOGAF certified enterprise architect
Professional photographer
freitasm:
That first article links to a DKIM software that doesn't exist anymore and you'd have to generate your keys to use it anyway.
If you running your own serever there are other software available. I use ThinkDKIM on my Windows SMTP server - it creates the keys, allows you to have multiple key pairs and guides you on configuring DNS changes. I also use Office 365 and have DKIM configured on that, with a different key pair and selector group.
If you are using Google or Office 365 both support DKIM by just checking a box and give you instruction to create the DNS entries.
You then create DMARC records to values that match your configuration settings. DMARC Analyzer does a good job of helping here.
I made mine via puttygen or open ssh on linux. not sure what software you mean as Puttygen and openSSH are both still around.
I mean the actual DKIM plugin described in step 3 (OpenDKIM) - the one that uses the key pair to sign the outgoing messages. That doesn't seem to exist anymore.
Backblaze cloud backup (personal and business) | Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) |
My technology disclosure | Business Transformation | Enterprise Content Management | Customer Relationship Management | Sharesies investment fund
freitasm:
I mean the actual DKIM plugin described in step 3 (OpenDKIM) - the one that uses the key pair to sign the outgoing messages. That doesn't seem to exist anymore.
Ironically their site uses a bad cert. Still running (seeit as http) but it is only a plugin to allow sendmail to recognise dkim - not to create dkim records or keys.
nunz:
freitasm:
I mean the actual DKIM plugin described in step 3 (OpenDKIM) - the one that uses the key pair to sign the outgoing messages. That doesn't seem to exist anymore.
Ironically their site uses a bad cert. Still running (seeit as http) but it is only a plugin to allow sendmail to recognise dkim - not to create dkim records or keys.
OpenDKIM is a fully fledged solution for signing and authenticating DKIM.
However, the way this thread is going suggests you should pony up and get some professional advice. The question you are asking requires the culmination of years of experience with email and servers.
So, I doubt anyone is going to offer to guide you through the whole A-Z setup of DKIM and bring you up to speed with all the other areas you will likely need to understand to get the whole thing functional, for free and in the space of this thread.
If you had a specific question which indicated you were well on the way and I had the time/inclination, I might provide you with a brief response. But your original post may as well say "help me setup a whole mail server", which is how I read it.
By way of example - looking at your original post - reverse DNS is not an email authentication standard and the fact you don't even know how to implement that, suggests there is a massive gap in your understanding. DMARC is not by itself an authetication standard either - it's standard for mail servers to report how they view a sender. And yes, I know the "MA" part is short for "message authentication" but that's a bit misleading if you view it in isolation. The point is how it all fits together. Why do you even want DMARC?
![]() ![]() |