A few tips from setting up SPF/DMARC/DKIM for a SAAS service:
* SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include.
* DMARC: to see a strict reject policy, check out Yahoo:
$ dig +short -t txt _dmarc.yahoo.com
"v=DMARC1\; p=reject\; pct=100\; rua=mailto:[email protected]\;"
* Mail forwarding: if your app sends mail as the logged-in user, make sure the user's actual email address is not in the FROM address as Yahoo does not authorize you to send FROM:
[email protected]* DMARC emails: use dmarcian.com to parse and process the auto-generated emails
* SPF: use the ~all for your first day of testing and then lock it down to -all after testing is complete
* DKIM: OpenDkim appears to be the most widely supported Linux software package.
* DKIM keys: setup a TXT entry you control and ask client to CNAME it. Then setup key rotation.
* SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include.
* DMARC: to see a strict reject policy, check out Yahoo:
* Mail forwarding: if your app sends mail as the logged-in user, make sure the user's actual email address is not in the FROM address as Yahoo does not authorize you to send FROM: [email protected]* DMARC emails: use dmarcian.com to parse and process the auto-generated emails
* SPF: use the ~all for your first day of testing and then lock it down to -all after testing is complete
* DKIM: OpenDkim appears to be the most widely supported Linux software package.
* DKIM keys: setup a TXT entry you control and ask client to CNAME it. Then setup key rotation.