• Sp chevron_right

      OpenDKIM and Postfix: Signing DKIM for multiple domains

      pubsub.slavino.sk / spam_resource · Tuesday, 2 November, 2021 - 12:00 · 1 minute

    How do I use OpenDKIM with multiple domain names on a single postfix server? That's a question I myself had when I first set up my current VPS to host my current email system. So I searched around a bit. I found this guide , but it's kind of a pain in. Too much heavy lifting.

    So I tried this instead. It's a bit of a hacker trick nobody seems to mention online: In your opendkim.conf file, where you specify the domain, you can just include multiple domains here, separated by commas.

    Instead of
    domain example.com
    Just put
    domain example.com,example.org,mydomain3.com
    In your opendkim.conf file.

    Upside : Super easy.
    Downside : All domains have to share the same DKIM key, because there's only one DKIM key setting in opendkim.conf.

    It works fine. Though you specify the domain name when creating a DKIM key, there's nothing in the key that is actually domain-specific. At scale, this is insecure. At the hobbyist level, where I've got three domains running on my one server that send a grand total of 150 emails a day, it's not a concern.

    You can also put an asterisk (*) to wildcard the domain setting in opendkim.conf. However, I don't recommend this, because it will try to sign all mail for any domain, without checking to see if a DKIM public key actually exists for that domain. So if you send or forward any mail at all for any other domain, that mail will end up with a broken DKIM signature attached to it. An example where this will happen and be very bad for you is mailing lists. Some mailing lists rewrite the from address to use their own domain to bypass DMARC concerns, but not all do, and some only do it sometimes. So I strongly recommend against using a wildcard here, unless you know what you're doing.


    Značky: #opendkim, #llinux, #dkim, #howto, #postfix, #Network

    • Sp chevron_right

      Ask Al: Help! I'm getting bounces for mail I didn't send

      pubsub.slavino.sk / spam_resource · Monday, 27 September, 2021 - 12:00 · 4 minutes

    help2.gif
    Help! I'm getting mail from MAILER-DAEMON@(various domains) with subject lines like: Delivery Status Notification (Failure), failure notice, Mail delivery failed: returning message to sender, Message Delivery Failure - Mail Delivery System, **Message you sent was blocked by our bulk email filter**, Recapito fallito, Returned mail: see transcript for details, Undelivered Mail Returned to Sender. These all seem to be bounces back from mail I didn't send. What is happening and how do I make it stop?

    In this case, my friend (the person experiencing this pain) owns their own domain name. What's happening here is that spammers are forging email addresses at their domain, using them as from addresses for their unwanted, garbage spam runs, so that bounces back from the spam come to them, because the spammer doesn't care about or want to process bounces.

    The good news is, as I mentioned all the way back in 2013 , is that spammers don't tend to fixate on one domain name or email address forever, so they'll probably move on to annoying somebody else shortly. But there are a few things you can do, as a domain owner, to help minimize the chances of having to receive these unwanted bounces:

    • Implement a Sender Policy Framework (SPF) DNS record for your domain name, specifying the IP addresses that are meant to send mail for your domain. Set it to " dash all " -- you want ISPs to know that they should be free to filter mail more harshly if it fails SPF validation checks.
    • Implement DKIM for your email sends. Even at the SMB level, most mail platforms provide instructions on how to configure things so that your email sends will all be authenticated via a DKIM signature. If you can't easily do this, SPF is quite likely "good enough" -- but if you can implement DKIM, you should. In some cases it's going to provide more robust email authentication compared to SPF. (I could spend another six pages diving into why I think that's the case, but in the interest of helping you move on with your life, I'll spare you.)
    • Implement DMARC . DMARC can be a bit scary in that you have to make sure all of the email you send legitimately is authenticated with SPF or DKIM. But, especially at the SMB level, you can do this. It's not hard, and don't let yourself be scared -- there are tools (like the colorful Mail Tester ) that will help you test your email authentication settings to make sure you've got it right. But the key here is that enabling DMARC, with a restrictive policy like p=reject, tells ISPs to block mail that purports to be from you, but doesn't pass SPF or DKIM. You don't HAVE to work with a DMARC monitoring partner to enable DMARC -- you can publish a TXT record for _dmarc.(your domain) that contains nothing more than "v=DMARC1; p=reject;" (without quotes) and that'd do it.

    DMARC is the key there. Turning that on means your domain name is no longer going to be useful to deliver spam to ISPs (like Gmail) that will block mail that fail DMARC. It makes your domain name much less palatable as an unauthorized spam sending domain.

    Bonus tip: If you own your own domain name and use it for email with something like Google Workspace, there's another setting you should look for and configure: The wildcard or catch-all email setting . It can be handy (and quite useful) to configure your email service to accept mail to any address at your domain -- for example, it can be used to create custom email addresses for different registration forms -- give irs@yourdomain to your accountant and bestbuy@yourdomain to the electronics retailer, so you can track usage and/or turn off an address later, if you want. Unfortunately, if you leave "catch-all" forwarding on, that means if a spammer makes up the address ihateyourguts@yourdomain and sends a bunch of spam, those bounces are going to come back to the "ihateyourguts" address and end up in your inbox. If you turn off the catch-all, that puts a stop to that. I know, it's a bummer to turn off the easy custom address ability, but it's something to consider -- weigh the plusses and minuses of being able to receive mail at any address at your domain, versus the unintended side effects of receiving unwanted "backscatter" bounces.

    I helped my friend implement all of these -- including disabling "catch-all" email forwarding (while helping them build a manual list of email aliases to continue forwarding to their main inbox) -- and we think it helped. It's not like we did a scientific study, but the bounces dropped off and disappeared pretty quickly. I think the spammers moved on to greener pastures.

    If you're new to all of this and wondering what SPF, DKIM and DMARC DNS records look like, here are the ones for spamresource.com: SPF , DKIM , DMARC . The SPF record contains the IP addresses of a couple of servers I own as well as an include showing that I utilize Google Workspace. The DKIM record (called a DKIM public key) is a DNS string provided by Google Workspace's DKIM configuration tool, and the DMARC record is just a very simple "tell ISPs to reject it if it doesn't pass authentication."


    Značky: #forgery, #help, #spam, #Network, #backscatter, #bounces, #spf, #dkim, #dmarc