316 lines
No EOL
116 KiB
HTML
316 lines
No EOL
116 KiB
HTML
<!DOCTYPE html><html lang="en" dir="ltr" data-theme="dark" data-has-toc data-has-sidebar class="astro-bguv2lll"> <head><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>Prevent spoofing using DKIM and SPF | ISPmail Guide</title><link rel="canonical" href="https://workaround.org/ispmail-trixie/anti-spoofing-dkim-spf/"/><link rel="sitemap" href="/sitemap-index.xml"/><script src="https://rybbit.workaround.org/api/script.js" data-site-id="1" async defer></script><link rel="shortcut icon" href="/favicon.svg" type="image/svg+xml"/><meta name="generator" content="Astro v5.16.6"/><meta name="generator" content="Starlight v0.35.3"/><meta property="og:title" content="Prevent spoofing using DKIM and SPF"/><meta property="og:type" content="article"/><meta property="og:url" content="https://workaround.org/ispmail-trixie/anti-spoofing-dkim-spf/"/><meta property="og:locale" content="en"/><meta property="og:description"/><meta property="og:site_name" content="ISPmail Guide"/><meta name="twitter:card" content="summary_large_image"/><script>
|
||
window.StarlightThemeProvider = (() => {
|
||
const storedTheme =
|
||
typeof localStorage !== 'undefined' && localStorage.getItem('starlight-theme');
|
||
const theme =
|
||
storedTheme ||
|
||
(window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark');
|
||
document.documentElement.dataset.theme = theme === 'light' ? 'light' : 'dark';
|
||
return {
|
||
updatePickers(theme = storedTheme || 'auto') {
|
||
document.querySelectorAll('starlight-theme-select').forEach((picker) => {
|
||
const select = picker.querySelector('select');
|
||
if (select) select.value = theme;
|
||
/** @type {HTMLTemplateElement | null} */
|
||
const tmpl = document.querySelector(`#theme-icons`);
|
||
const newIcon = tmpl && tmpl.content.querySelector('.' + theme);
|
||
if (newIcon) {
|
||
const oldIcon = picker.querySelector('svg.label-icon');
|
||
if (oldIcon) {
|
||
oldIcon.replaceChildren(...newIcon.cloneNode(true).childNodes);
|
||
}
|
||
}
|
||
});
|
||
},
|
||
};
|
||
})();
|
||
</script><template id="theme-icons"><svg aria-hidden="true" class="light astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M5 12a1 1 0 0 0-1-1H3a1 1 0 0 0 0 2h1a1 1 0 0 0 1-1Zm.64 5-.71.71a1 1 0 0 0 0 1.41 1 1 0 0 0 1.41 0l.71-.71A1 1 0 0 0 5.64 17ZM12 5a1 1 0 0 0 1-1V3a1 1 0 0 0-2 0v1a1 1 0 0 0 1 1Zm5.66 2.34a1 1 0 0 0 .7-.29l.71-.71a1 1 0 1 0-1.41-1.41l-.66.71a1 1 0 0 0 0 1.41 1 1 0 0 0 .66.29Zm-12-.29a1 1 0 0 0 1.41 0 1 1 0 0 0 0-1.41l-.71-.71a1.004 1.004 0 1 0-1.43 1.41l.73.71ZM21 11h-1a1 1 0 0 0 0 2h1a1 1 0 0 0 0-2Zm-2.64 6A1 1 0 0 0 17 18.36l.71.71a1 1 0 0 0 1.41 0 1 1 0 0 0 0-1.41l-.76-.66ZM12 6.5a5.5 5.5 0 1 0 5.5 5.5A5.51 5.51 0 0 0 12 6.5Zm0 9a3.5 3.5 0 1 1 0-7 3.5 3.5 0 0 1 0 7Zm0 3.5a1 1 0 0 0-1 1v1a1 1 0 0 0 2 0v-1a1 1 0 0 0-1-1Z"/></svg><svg aria-hidden="true" class="dark astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21.64 13a1 1 0 0 0-1.05-.14 8.049 8.049 0 0 1-3.37.73 8.15 8.15 0 0 1-8.14-8.1 8.59 8.59 0 0 1 .25-2A1 1 0 0 0 8 2.36a10.14 10.14 0 1 0 14 11.69 1 1 0 0 0-.36-1.05Zm-9.5 6.69A8.14 8.14 0 0 1 7.08 5.22v.27a10.15 10.15 0 0 0 10.14 10.14 9.784 9.784 0 0 0 2.1-.22 8.11 8.11 0 0 1-7.18 4.32v-.04Z"/></svg><svg aria-hidden="true" class="auto astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg></template><link rel="stylesheet" href="/_astro/print.DNXP8c50.css" media="print"><link rel="stylesheet" href="/_astro/index.DpSp7KkT.css">
|
||
<style>@layer starlight.components{:root{--sl-badge-default-border: var(--sl-color-accent);--sl-badge-default-bg: var(--sl-color-accent-low);--sl-badge-default-text: #fff;--sl-badge-note-border: var(--sl-color-blue);--sl-badge-note-bg: var(--sl-color-blue-low);--sl-badge-note-text: #fff;--sl-badge-danger-border: var(--sl-color-red);--sl-badge-danger-bg: var(--sl-color-red-low);--sl-badge-danger-text: #fff;--sl-badge-success-border: var(--sl-color-green);--sl-badge-success-bg: var(--sl-color-green-low);--sl-badge-success-text: #fff;--sl-badge-caution-border: var(--sl-color-orange);--sl-badge-caution-bg: var(--sl-color-orange-low);--sl-badge-caution-text: #fff;--sl-badge-tip-border: var(--sl-color-purple);--sl-badge-tip-bg: var(--sl-color-purple-low);--sl-badge-tip-text: #fff}[data-theme=light]:root{--sl-badge-default-bg: var(--sl-color-accent-high);--sl-badge-note-bg: var(--sl-color-blue-high);--sl-badge-danger-bg: var(--sl-color-red-high);--sl-badge-success-bg: var(--sl-color-green-high);--sl-badge-caution-bg: var(--sl-color-orange-high);--sl-badge-tip-bg: var(--sl-color-purple-high)}.sl-badge:where(.astro-avdet4wd){display:inline-block;border:1px solid var(--sl-color-border-badge);border-radius:.25rem;font-family:var(--sl-font-system-mono);line-height:normal;color:var(--sl-color-text-badge);background-color:var(--sl-color-bg-badge);overflow-wrap:anywhere}.sidebar-content .sl-badge:where(.astro-avdet4wd){line-height:1;font-size:var(--sl-text-xs);padding:.125rem .375rem}.sidebar-content a[aria-current=page]>.sl-badge:where(.astro-avdet4wd){--sl-color-bg-badge: transparent;--sl-color-border-badge: currentColor;color:inherit}.default:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-default-bg);--sl-color-border-badge: var(--sl-badge-default-border);--sl-color-text-badge: var(--sl-badge-default-text)}.note:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-note-bg);--sl-color-border-badge: var(--sl-badge-note-border);--sl-color-text-badge: var(--sl-badge-note-text)}.danger:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-danger-bg);--sl-color-border-badge: var(--sl-badge-danger-border);--sl-color-text-badge: var(--sl-badge-danger-text)}.success:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-success-bg);--sl-color-border-badge: var(--sl-badge-success-border);--sl-color-text-badge: var(--sl-badge-success-text)}.tip:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-tip-bg);--sl-color-border-badge: var(--sl-badge-tip-border);--sl-color-text-badge: var(--sl-badge-tip-text)}.caution:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-caution-bg);--sl-color-border-badge: var(--sl-badge-caution-border);--sl-color-text-badge: var(--sl-badge-caution-text)}.small:where(.astro-avdet4wd){font-size:var(--sl-text-xs);padding:.125rem .25rem}.medium:where(.astro-avdet4wd){font-size:var(--sl-text-sm);padding:.175rem .35rem}.large:where(.astro-avdet4wd){font-size:var(--sl-text-base);padding:.225rem .45rem}.sl-markdown-content :is(h1,h2,h3,h4,h5,h6) .sl-badge:where(.astro-avdet4wd){vertical-align:middle}}
|
||
@layer starlight.components{.card-grid:where(.astro-zntqmydn){display:grid;grid-template-columns:100%;gap:1rem}.card-grid:where(.astro-zntqmydn)>*{margin-top:0!important}@media(min-width:50rem){.card-grid:where(.astro-zntqmydn){grid-template-columns:1fr 1fr;gap:1.5rem}.stagger:where(.astro-zntqmydn){--stagger-height: 5rem;padding-bottom:var(--stagger-height)}.stagger:where(.astro-zntqmydn)>*:nth-child(2n){transform:translateY(var(--stagger-height))}}}
|
||
@layer starlight.components{.card:where(.astro-v5tidmuc){--sl-card-border: var(--sl-color-purple);--sl-card-bg: var(--sl-color-purple-low);border:1px solid var(--sl-color-gray-5);background-color:var(--sl-color-black);padding:clamp(1rem,calc(.125rem + 3vw),2.5rem);flex-direction:column;gap:clamp(.5rem,calc(.125rem + 1vw),1rem)}.card:where(.astro-v5tidmuc):nth-child(4n+1){--sl-card-border: var(--sl-color-orange);--sl-card-bg: var(--sl-color-orange-low)}.card:where(.astro-v5tidmuc):nth-child(4n+3){--sl-card-border: var(--sl-color-green);--sl-card-bg: var(--sl-color-green-low)}.card:where(.astro-v5tidmuc):nth-child(4n+4){--sl-card-border: var(--sl-color-red);--sl-card-bg: var(--sl-color-red-low)}.card:where(.astro-v5tidmuc):nth-child(4n+5){--sl-card-border: var(--sl-color-blue);--sl-card-bg: var(--sl-color-blue-low)}.title:where(.astro-v5tidmuc){font-weight:600;font-size:var(--sl-text-h4);color:var(--sl-color-white);line-height:var(--sl-line-height-headings);gap:1rem;align-items:center}.card:where(.astro-v5tidmuc) .icon:where(.astro-v5tidmuc){border:1px solid var(--sl-card-border);background-color:var(--sl-card-bg);padding:.2em;border-radius:.25rem;flex-shrink:0}.card:where(.astro-v5tidmuc) .body:where(.astro-v5tidmuc){margin:0;font-size:clamp(var(--sl-text-sm),calc(.5rem + 1vw),var(--sl-text-body))}}
|
||
@layer starlight.components{svg:where(.astro-c6vsoqas){color:var(--sl-icon-color);font-size:var(--sl-icon-size, 1em);width:1em;height:1em}}
|
||
@layer starlight.components{starlight-tabs:where(.astro-esqgolmp){display:block}.tablist-wrapper:where(.astro-esqgolmp){overflow-x:auto}:where(.astro-esqgolmp)[role=tablist]{display:flex;list-style:none;border-bottom:2px solid var(--sl-color-gray-5);padding:0}.tab:where(.astro-esqgolmp){margin-bottom:-2px}.tab:where(.astro-esqgolmp)>:where(.astro-esqgolmp)[role=tab]{display:flex;align-items:center;gap:.5rem;padding:0 1.25rem;text-decoration:none;border-bottom:2px solid var(--sl-color-gray-5);color:var(--sl-color-gray-3);outline-offset:var(--sl-outline-offset-inside);overflow-wrap:initial}.tab:where(.astro-esqgolmp) :where(.astro-esqgolmp)[role=tab][aria-selected=true]{color:var(--sl-color-white);border-color:var(--sl-color-text-accent);font-weight:600}.tablist-wrapper:where(.astro-esqgolmp)~[role=tabpanel]{margin-top:1rem}}
|
||
@layer starlight.components{.sl-steps{--bullet-size: calc(var(--sl-line-height) * 1rem);--bullet-margin: .375rem;list-style:none;counter-reset:steps-counter var(--sl-steps-start, 0);padding-inline-start:0}.sl-steps>li{counter-increment:steps-counter;position:relative;padding-inline-start:calc(var(--bullet-size) + 1rem);padding-bottom:1px;min-height:calc(var(--bullet-size) + var(--bullet-margin))}.sl-steps>li+li{margin-top:0}.sl-steps>li:before{content:counter(steps-counter);position:absolute;top:0;inset-inline-start:0;width:var(--bullet-size);height:var(--bullet-size);line-height:var(--bullet-size);font-size:var(--sl-text-xs);font-weight:600;text-align:center;color:var(--sl-color-white);background-color:var(--sl-color-gray-6);border-radius:99rem;box-shadow:inset 0 0 0 1px var(--sl-color-gray-5)}.sl-steps>li:after{--guide-width: 1px;content:"";position:absolute;top:calc(var(--bullet-size) + var(--bullet-margin));bottom:var(--bullet-margin);inset-inline-start:calc((var(--bullet-size) - var(--guide-width)) / 2);width:var(--guide-width);background-color:var(--sl-color-hairline-light)}}@layer starlight.content{.sl-steps>li>:first-child{--lh: calc(1em * var(--sl-line-height));--shift-y: calc(.5 * (var(--bullet-size) - var(--lh)));transform:translateY(var(--shift-y));margin-bottom:var(--shift-y)}.sl-steps>li>:first-child:where(h1,h2,h3,h4,h5,h6){--lh: calc(1em * var(--sl-line-height-headings))}@supports (--prop: 1lh){.sl-steps>li>:first-child{--lh: 1lh}}}
|
||
@layer starlight.components{starlight-file-tree:where(.astro-p67cqifm){--x-space: 1.5rem;--y-space: .125rem;--y-pad: 0;display:block;border:1px solid var(--sl-color-gray-5);padding:1rem;background-color:var(--sl-color-gray-6);font-size:var(--sl-text-xs);font-family:var(--__sl-font-mono);overflow-x:auto}starlight-file-tree:where(.astro-p67cqifm) .directory>details{border:0;padding:0;padding-inline-start:var(--x-space);background:transparent}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary{margin-inline-start:calc(-1 * var(--x-space));border:0;padding:var(--y-pad) .625rem;font-weight:400;color:var(--sl-color-white);max-width:100%}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary::marker,starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary::-webkit-details-marker{color:var(--sl-color-gray-3)}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover,starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover .tree-icon{cursor:pointer;color:var(--sl-color-text-accent);fill:currentColor}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover~ul{border-color:var(--sl-color-gray-4)}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover .highlight .tree-icon{color:var(--sl-color-text-invert);fill:currentColor}starlight-file-tree:where(.astro-p67cqifm) ul{margin-inline-start:.5rem;border-inline-start:1px solid var(--sl-color-gray-5);padding:0;padding-inline-start:.125rem;list-style:none}starlight-file-tree:where(.astro-p67cqifm)>ul{margin:0;border:0;padding:0}starlight-file-tree:where(.astro-p67cqifm) li{margin:var(--y-space) 0;padding:var(--y-pad) 0}starlight-file-tree:where(.astro-p67cqifm) .file{margin-inline-start:calc(var(--x-space) - .125rem);color:var(--sl-color-white)}starlight-file-tree:where(.astro-p67cqifm) .tree-entry{display:inline-flex;align-items:flex-start;flex-wrap:wrap;max-width:calc(100% - 1rem)}@media(min-width:30em){starlight-file-tree:where(.astro-p67cqifm) .tree-entry{flex-wrap:nowrap}}starlight-file-tree:where(.astro-p67cqifm) .tree-entry>:first-child{flex-shrink:0}starlight-file-tree:where(.astro-p67cqifm) .empty{color:var(--sl-color-gray-3);padding-inline-start:.375rem}starlight-file-tree:where(.astro-p67cqifm) .comment{color:var(--sl-color-gray-3);padding-inline-start:1.625rem;max-width:24rem;min-width:12rem}starlight-file-tree:where(.astro-p67cqifm) .highlight{display:inline-block;border-radius:.25rem;padding-inline-end:.5rem;color:var(--sl-color-text-invert);background-color:var(--sl-color-text-accent)}starlight-file-tree:where(.astro-p67cqifm) svg{display:inline;fill:var(--sl-color-gray-3);vertical-align:middle;margin-inline:.25rem .375rem;width:.875rem;height:.875rem}starlight-file-tree:where(.astro-p67cqifm) .highlight svg.tree-icon{fill:currentColor}}
|
||
@layer starlight.components{.sl-link-button:where(.astro-xwgiixxa){align-items:center;border:1px solid transparent;border-radius:999rem;display:inline-flex;font-size:var(--sl-text-sm);gap:.5em;line-height:1.1875;outline-offset:.25rem;padding:.4375rem 1.125rem;text-decoration:none}.sl-link-button:where(.astro-xwgiixxa).primary{background:var(--sl-color-text-accent);border-color:var(--sl-color-text-accent);color:var(--sl-color-black)}.sl-link-button:where(.astro-xwgiixxa).primary:hover{color:var(--sl-color-black)}.sl-link-button:where(.astro-xwgiixxa).secondary{border-color:inherit;color:var(--sl-color-white)}.sl-link-button:where(.astro-xwgiixxa).minimal{color:var(--sl-color-white);padding-inline:0}.sl-link-button:where(.astro-xwgiixxa) svg{flex-shrink:0}@media(min-width:50rem){.sl-link-button:where(.astro-xwgiixxa){font-size:var(--sl-text-base);padding:.9375rem 1.25rem}}.sl-markdown-content .sl-link-button:where(.astro-xwgiixxa){margin-inline-end:1rem}.sl-markdown-content .sl-link-button:where(.astro-xwgiixxa):not(:where(p *)){margin-block:1rem}}
|
||
</style><script type="module" src="/_astro/page.B1D-nYk3.js"></script></head> <body class="astro-bguv2lll"> <a href="#_top" class="astro-7q3lir66">Skip to content</a> <div class="page sl-flex astro-vrdttmbt"> <header class="header astro-vrdttmbt"><div class="header astro-kmkmnagf"> <div class="title-wrapper sl-flex astro-kmkmnagf"> <a href="/" class="site-title sl-flex astro-m46x6ez3"> <img class="light:sl-hidden print:hidden astro-m46x6ez3" alt src="/_astro/logo-dark.DlBk_-6-.svg" width="146" height="37"> <img class="dark:sl-hidden print:block astro-m46x6ez3" alt src="/_astro/logo.DfR9nmxN.svg" width="146" height="37"> <span class="sr-only astro-m46x6ez3" translate="no"> ISPmail Guide </span> </a> </div> <div class="sl-flex print:hidden astro-kmkmnagf"> <site-search class="astro-kmkmnagf astro-v37mnknz" data-translations="{"placeholder":"Search"}"> <button data-open-modal disabled aria-label="Search" aria-keyshortcuts="Control+K" class="astro-v37mnknz"> <svg aria-hidden="true" class="astro-v37mnknz astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21.71 20.29 18 16.61A9 9 0 1 0 16.61 18l3.68 3.68a.999.999 0 0 0 1.42 0 1 1 0 0 0 0-1.39ZM11 18a7 7 0 1 1 0-14 7 7 0 0 1 0 14Z"/></svg> <span class="sl-hidden md:sl-block astro-v37mnknz" aria-hidden="true">Search</span> <kbd class="sl-hidden md:sl-flex astro-v37mnknz" style="display: none;"> <kbd class="astro-v37mnknz">Ctrl</kbd><kbd class="astro-v37mnknz">K</kbd> </kbd> </button> <dialog style="padding:0" aria-label="Search" class="astro-v37mnknz"> <div class="dialog-frame sl-flex astro-v37mnknz"> <button data-close-modal class="sl-flex md:sl-hidden astro-v37mnknz"> Cancel </button> <div class="search-container astro-v37mnknz"> <div id="starlight__search" class="astro-v37mnknz"></div> </div> </div> </dialog> </site-search> <script>
|
||
(() => {
|
||
const openBtn = document.querySelector('button[data-open-modal]');
|
||
const shortcut = openBtn?.querySelector('kbd');
|
||
if (!openBtn || !(shortcut instanceof HTMLElement)) return;
|
||
const platformKey = shortcut.querySelector('kbd');
|
||
if (platformKey && /(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)) {
|
||
platformKey.textContent = '⌘';
|
||
openBtn.setAttribute('aria-keyshortcuts', 'Meta+K');
|
||
}
|
||
shortcut.style.display = '';
|
||
})();
|
||
</script> <script type="module" src="/_astro/Search.astro_astro_type_script_index_0_lang.cjYDvRdi.js"></script> </div> <div class="sl-hidden md:sl-flex print:hidden right-group astro-kmkmnagf"> <div class="sl-flex social-icons astro-kmkmnagf"> <a href="https://git.workaround.org/chaas/ispmail-workaround-org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Git</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M0.355 12.231L0.355 12.231L0.355 11.853Q0.397 11.517 0.565 11.265L0.565 11.265Q0.691 11.097 0.943 10.803L0.943 10.803L1.279 10.425L7.831 3.831L7.873 3.873Q7.957 3.873 7.957 3.957L7.957 3.957L10.309 6.351Q10.519 6.519 10.309 6.729L10.309 6.729Q10.225 7.317 10.435 7.863Q10.645 8.409 11.107 8.703L11.107 8.703Q11.275 8.787 11.317 8.892Q11.359 8.997 11.359 9.207L11.359 9.207L11.359 15.003Q11.359 15.255 11.107 15.507L11.107 15.507Q10.603 15.843 10.372 16.389Q10.141 16.935 10.330 17.502Q10.519 18.069 10.981 18.447Q11.443 18.825 12.031 18.825Q12.619 18.825 13.081 18.489Q13.543 18.153 13.732 17.586Q13.921 17.019 13.753 16.473Q13.585 15.927 13.081 15.507L13.081 15.507Q12.913 15.423 12.871 15.318Q12.829 15.213 12.829 15.003L12.829 15.003L12.829 9.081L12.955 9.081L15.055 11.181Q15.139 11.265 15.139 11.391L15.139 11.391L15.181 11.475L15.181 12.231Q15.265 13.029 15.874 13.470Q16.483 13.911 17.281 13.806Q18.079 13.701 18.562 13.029Q19.045 12.357 18.835 11.601L18.835 11.601Q18.751 10.929 18.100 10.488Q17.449 10.047 16.735 10.131L16.735 10.131Q16.483 10.131 16.231 10.005L16.231 10.005L14.005 7.779Q13.879 7.653 13.879 7.401L13.879 7.401Q14.005 6.813 13.711 6.267Q13.417 5.721 12.871 5.448Q12.325 5.175 11.779 5.301L11.779 5.301Q11.359 5.301 11.359 5.175L11.359 5.175Q9.805 3.579 9.007 2.907L9.007 2.907Q8.797 2.739 9.007 2.529L9.007 2.529Q9.469 2.193 10.183 1.353L10.183 1.353L10.729 0.807Q11.905-0.369 13.081 0.807L13.081 0.807L23.035 10.803Q24.253 11.979 23.035 13.155L23.035 13.155L13.291 22.941Q12.913 23.319 12.745 23.445L12.745 23.445Q12.409 23.739 12.031 23.781L12.031 23.781L11.779 23.781L11.569 23.697Q11.065 23.487 10.855 23.277L10.855 23.277L10.057 22.479Q8.881 21.387 8.335 20.757L8.335 20.757L1.153 13.575Q1.069 13.365 0.775 13.029L0.775 13.029Q0.397 12.525 0.355 12.231Z"/></svg></a><a href="https://riot.im/app/#/room/#ispmail:matrix.org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Matrix</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M22.5 1.5v21h-2.25V24H24V0h-3.75v1.5h2.25ZM7.46 7.95V9.1h.04a3.02 3.02 0 0 1 2.61-1.39c.54 0 1.03.1 1.48.32.44.2.78.58 1.01 1.1.26-.37.6-.7 1.03-.99.44-.28.95-.43 1.55-.43.45 0 .87.06 1.26.17.38.11.71.29.99.53.27.24.49.56.64.95.15.4.23.86.23 1.42v5.72h-2.34v-4.85c0-.29-.01-.56-.04-.8a1.73 1.73 0 0 0-.18-.67 1.1 1.1 0 0 0-.44-.45 1.6 1.6 0 0 0-.78-.16c-.33 0-.6.06-.8.19-.2.12-.37.29-.48.5a2 2 0 0 0-.23.69c-.04.26-.06.52-.06.78v4.77H10.6v-4.8l-.01-.75a2.29 2.29 0 0 0-.14-.69c-.08-.2-.23-.38-.42-.5a1.5 1.5 0 0 0-.85-.2c-.15.01-.3.04-.44.08-.19.06-.37.15-.52.28-.18.14-.32.34-.44.6-.12.26-.18.6-.18 1.02v4.96H5.25V7.94h2.21ZM1.5 1.5v21h2.25V24H0V0h3.75v1.5H1.5Z"/></svg></a><a href="https://comentario.workaround.org/api/rss/comments?domain=0f111a27-fbfa-48af-8beb-ab12e612d92f" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Feed</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M2.88 16.88a3 3 0 0 0 0 4.24 3 3 0 0 0 4.24 0 3 3 0 0 0-4.24-4.24Zm2.83 2.83a1 1 0 0 1-1.42-1.42 1 1 0 0 1 1.42 0 1 1 0 0 1 0 1.42ZM5 12a1 1 0 0 0 0 2 5 5 0 0 1 5 5 1 1 0 0 0 2 0 7 7 0 0 0-7-7Zm0-4a1 1 0 0 0 0 2 9 9 0 0 1 9 9 1 1 0 0 0 2 0 11.08 11.08 0 0 0-3.22-7.78A11.08 11.08 0 0 0 5 8Zm10.61.39A15.11 15.11 0 0 0 5 4a1 1 0 0 0 0 2 13 13 0 0 1 13 13 1 1 0 0 0 2 0 15.11 15.11 0 0 0-4.39-10.61Z"/></svg></a> </div> <starlight-theme-select> <label style="--sl-select-width: 6.25em" class="astro-4yphtoen"> <span class="sr-only astro-4yphtoen">Select theme</span> <svg aria-hidden="true" class="icon label-icon astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg> <select autocomplete="off" class="astro-4yphtoen"> <option value="dark" class="astro-4yphtoen">Dark</option><option value="light" class="astro-4yphtoen">Light</option><option value="auto" selected class="astro-4yphtoen">Auto</option> </select> <svg aria-hidden="true" class="icon caret astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M17 9.17a1 1 0 0 0-1.41 0L12 12.71 8.46 9.17a1 1 0 1 0-1.41 1.42l4.24 4.24a1.002 1.002 0 0 0 1.42 0L17 10.59a1.002 1.002 0 0 0 0-1.42Z"/></svg> </label> </starlight-theme-select> <script>
|
||
StarlightThemeProvider.updatePickers();
|
||
</script> <script type="module">const r="starlight-theme",o=e=>e==="auto"||e==="dark"||e==="light"?e:"auto",c=()=>o(typeof localStorage<"u"&&localStorage.getItem(r));function n(e){typeof localStorage<"u"&&localStorage.setItem(r,e==="light"||e==="dark"?e:"")}const l=()=>matchMedia("(prefers-color-scheme: light)").matches?"light":"dark";function t(e){StarlightThemeProvider.updatePickers(e),document.documentElement.dataset.theme=e==="auto"?l():e,n(e)}matchMedia("(prefers-color-scheme: light)").addEventListener("change",()=>{c()==="auto"&&t("auto")});class s extends HTMLElement{constructor(){super(),t(c()),this.querySelector("select")?.addEventListener("change",a=>{a.currentTarget instanceof HTMLSelectElement&&t(o(a.currentTarget.value))})}}customElements.define("starlight-theme-select",s);</script> <script type="module">class s extends HTMLElement{constructor(){super();const e=this.querySelector("select");e&&(e.addEventListener("change",t=>{t.currentTarget instanceof HTMLSelectElement&&(window.location.pathname=t.currentTarget.value)}),window.addEventListener("pageshow",t=>{if(!t.persisted)return;const n=e.querySelector("option[selected]")?.index;n!==e.selectedIndex&&(e.selectedIndex=n??0)}))}}customElements.define("starlight-lang-select",s);</script> </div> </div> </header> <nav class="sidebar print:hidden astro-vrdttmbt" aria-label="Main"> <starlight-menu-button class="print:hidden astro-jif73yzw"> <button aria-expanded="false" aria-label="Menu" aria-controls="starlight__sidebar" class="sl-flex md:sl-hidden astro-jif73yzw"> <svg aria-hidden="true" class="open-menu astro-jif73yzw astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M3 8h18a1 1 0 1 0 0-2H3a1 1 0 0 0 0 2Zm18 8H3a1 1 0 0 0 0 2h18a1 1 0 0 0 0-2Zm0-5H3a1 1 0 0 0 0 2h18a1 1 0 0 0 0-2Z"/></svg> <svg aria-hidden="true" class="close-menu astro-jif73yzw astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="m13.41 12 6.3-6.29a1.004 1.004 0 1 0-1.42-1.42L12 10.59l-6.29-6.3a1.004 1.004 0 0 0-1.42 1.42l6.3 6.29-6.3 6.29a1 1 0 0 0 0 1.42.998.998 0 0 0 1.42 0l6.29-6.3 6.29 6.3a.999.999 0 0 0 1.42 0 1 1 0 0 0 0-1.42L13.41 12Z"/></svg> </button> </starlight-menu-button> <script type="module">class s extends HTMLElement{constructor(){super(),this.btn=this.querySelector("button"),this.btn.addEventListener("click",()=>this.toggleExpanded());const t=this.closest("nav");t&&t.addEventListener("keyup",e=>this.closeOnEscape(e))}setExpanded(t){this.setAttribute("aria-expanded",String(t)),document.body.toggleAttribute("data-mobile-menu-expanded",t)}toggleExpanded(){this.setExpanded(this.getAttribute("aria-expanded")!=="true")}closeOnEscape(t){t.code==="Escape"&&(this.setExpanded(!1),this.btn.focus())}}customElements.define("starlight-menu-button",s);</script> <div id="starlight__sidebar" class="sidebar-pane astro-vrdttmbt"> <div class="sidebar-content sl-flex astro-vrdttmbt"> <sl-sidebar-state-persist data-hash="01h4vp7" class="astro-kku4brbg"> <script aria-hidden="true">
|
||
(() => {
|
||
try {
|
||
if (!matchMedia('(min-width: 50em)').matches) return;
|
||
/** @type {HTMLElement | null} */
|
||
const target = document.querySelector('sl-sidebar-state-persist');
|
||
const state = JSON.parse(sessionStorage.getItem('sl-sidebar-state') || '0');
|
||
if (!target || !state || target.dataset.hash !== state.hash) return;
|
||
window._starlightScrollRestore = state.scroll;
|
||
customElements.define(
|
||
'sl-sidebar-restore',
|
||
class SidebarRestore extends HTMLElement {
|
||
connectedCallback() {
|
||
try {
|
||
const idx = parseInt(this.dataset.index || '');
|
||
const details = this.closest('details');
|
||
if (details && typeof state.open[idx] === 'boolean') details.open = state.open[idx];
|
||
} catch {}
|
||
}
|
||
}
|
||
);
|
||
} catch {}
|
||
})();
|
||
</script> <ul class="top-level astro-3ii7xxms"> <li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="0"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">ISPmail for Debian 13</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/ispmail-trixie/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Start here</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/upgrading/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Upgrading from Debian Bookworm</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/install-debian/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Installing Debian</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/install-the-software-packages/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Install software packages</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/virtual-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Virtual domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Database setup</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/overview/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Big picture</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/dns-records/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">DNS records</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/tls-certificate/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">TLS certificate</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/postfix/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Postfix</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/lmtp/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">LMTP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/webmail/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Webmail using Roundcube</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/relaying/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Sending / Relaying</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/imap/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">IMAP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/managing-users-aliases-and-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Managing users, aliases and domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/catching-spam-with-rspamd/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catching spam with rspamd</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/anti-spoofing-dkim-spf/" aria-current="page" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Prevent spoofing using DKIM and SPF</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/catch-all/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catch-all addresses</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/quotas/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Quotas</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/going-live/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Going live</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/automated-installation/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Automated installation</span> </a> </li> </ul> </details> </li><li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="1"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">ISPmail for Debian 12</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Start here</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/whats-new/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">What's new</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/migrating-from-a-bullseye-to-a-bookworm-server/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Migrating from your old (Bullseye) server</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/big-picture/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">The big picture</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/types-of-email-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Types of email domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/install-debian-bookworm-on-your-server/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Installing Debian</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/install-the-software-packages/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Install software packages</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/creating-a-tls-encryption-key-and-certificate/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">TLS certificate</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/prepare-the-database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Preparing the database</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/making-postfix-get-its-information-from-the-mariadb-database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Let Postfix access MariaDB</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/catchall-aliases/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catch-all aliases</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/setting-up-dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Setting up Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/let-postfix-send-emails-to-dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Let Postfix send emails to Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/quotas/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Quotas</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/testing-imap/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Testing IMAP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/webmail-using-roundcube/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Webmail using Roundcube</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/testing-email-delivery/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Testing email delivery</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/relaying-outgoing-emails-through-postfix/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Relaying outgoing emails through Postfix</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/catching-spam-with-rspamd/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catching spam with rspamd</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/setting-dns-records/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Setting DNS records</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/prevent-spoofing-using-dkim/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Prevent spoofing using DKIM</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/managing-users-aliases-and-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Managing users, aliases and domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/monitoring-and-backup/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Monitoring and Backup</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/automatic-installation-with-ansible/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Automatic installation with Ansible</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/success-stories/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Success stories</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/faq-frequently-asked-questions/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">FAQ (frequently asked questions)</span> </a> </li> </ul> </details> </li><li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="2"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">Misc articles</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/article/updating-the-bios-on-lenovo-laptops-from-linux-using-a-usb-flash-stick/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Updating the BIOS on Lenovo laptops from Linux using a USB flash stick</span> </a> </li><li class="astro-3ii7xxms"> <a href="/bacula-cheatsheet/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Bareos/Bacula Cheat Sheet</span> </a> </li><li class="astro-3ii7xxms"> <a href="/debian-packages-are-so-old/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Debian packages are so old</span> </a> </li><li class="astro-3ii7xxms"> <a href="/getting-help-on-irc/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Getting help on IRC</span> </a> </li><li class="astro-3ii7xxms"> <a href="/linux/renaming-multiple-files/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Renaming multiple files</span> </a> </li><li class="astro-3ii7xxms"> <a href="/linuxtip/pipes/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Pipes and redirection</span> </a> </li><li class="astro-3ii7xxms"> <a href="/rsnapshot-and-usb-drives/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Backups with rsnaphot to external USB drives</span> </a> </li><li class="astro-3ii7xxms"> <a href="/squid-acls/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">How Squid ACLs work</span> </a> </li><li class="astro-3ii7xxms"> <a href="/understanding-lvm/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Understanding the Logical Volume Manager (LVM)</span> </a> </li> </ul> </details> </li> </ul> <script aria-hidden="true">
|
||
(() => {
|
||
const scroller = document.getElementById('starlight__sidebar');
|
||
if (!window._starlightScrollRestore || !scroller) return;
|
||
scroller.scrollTop = window._starlightScrollRestore;
|
||
delete window._starlightScrollRestore;
|
||
})();
|
||
</script> </sl-sidebar-state-persist> <div class="md:sl-hidden"> <div class="mobile-preferences sl-flex astro-wu23bvmt"> <div class="social-icons astro-wu23bvmt"> <a href="https://git.workaround.org/chaas/ispmail-workaround-org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Git</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M0.355 12.231L0.355 12.231L0.355 11.853Q0.397 11.517 0.565 11.265L0.565 11.265Q0.691 11.097 0.943 10.803L0.943 10.803L1.279 10.425L7.831 3.831L7.873 3.873Q7.957 3.873 7.957 3.957L7.957 3.957L10.309 6.351Q10.519 6.519 10.309 6.729L10.309 6.729Q10.225 7.317 10.435 7.863Q10.645 8.409 11.107 8.703L11.107 8.703Q11.275 8.787 11.317 8.892Q11.359 8.997 11.359 9.207L11.359 9.207L11.359 15.003Q11.359 15.255 11.107 15.507L11.107 15.507Q10.603 15.843 10.372 16.389Q10.141 16.935 10.330 17.502Q10.519 18.069 10.981 18.447Q11.443 18.825 12.031 18.825Q12.619 18.825 13.081 18.489Q13.543 18.153 13.732 17.586Q13.921 17.019 13.753 16.473Q13.585 15.927 13.081 15.507L13.081 15.507Q12.913 15.423 12.871 15.318Q12.829 15.213 12.829 15.003L12.829 15.003L12.829 9.081L12.955 9.081L15.055 11.181Q15.139 11.265 15.139 11.391L15.139 11.391L15.181 11.475L15.181 12.231Q15.265 13.029 15.874 13.470Q16.483 13.911 17.281 13.806Q18.079 13.701 18.562 13.029Q19.045 12.357 18.835 11.601L18.835 11.601Q18.751 10.929 18.100 10.488Q17.449 10.047 16.735 10.131L16.735 10.131Q16.483 10.131 16.231 10.005L16.231 10.005L14.005 7.779Q13.879 7.653 13.879 7.401L13.879 7.401Q14.005 6.813 13.711 6.267Q13.417 5.721 12.871 5.448Q12.325 5.175 11.779 5.301L11.779 5.301Q11.359 5.301 11.359 5.175L11.359 5.175Q9.805 3.579 9.007 2.907L9.007 2.907Q8.797 2.739 9.007 2.529L9.007 2.529Q9.469 2.193 10.183 1.353L10.183 1.353L10.729 0.807Q11.905-0.369 13.081 0.807L13.081 0.807L23.035 10.803Q24.253 11.979 23.035 13.155L23.035 13.155L13.291 22.941Q12.913 23.319 12.745 23.445L12.745 23.445Q12.409 23.739 12.031 23.781L12.031 23.781L11.779 23.781L11.569 23.697Q11.065 23.487 10.855 23.277L10.855 23.277L10.057 22.479Q8.881 21.387 8.335 20.757L8.335 20.757L1.153 13.575Q1.069 13.365 0.775 13.029L0.775 13.029Q0.397 12.525 0.355 12.231Z"/></svg></a><a href="https://riot.im/app/#/room/#ispmail:matrix.org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Matrix</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M22.5 1.5v21h-2.25V24H24V0h-3.75v1.5h2.25ZM7.46 7.95V9.1h.04a3.02 3.02 0 0 1 2.61-1.39c.54 0 1.03.1 1.48.32.44.2.78.58 1.01 1.1.26-.37.6-.7 1.03-.99.44-.28.95-.43 1.55-.43.45 0 .87.06 1.26.17.38.11.71.29.99.53.27.24.49.56.64.95.15.4.23.86.23 1.42v5.72h-2.34v-4.85c0-.29-.01-.56-.04-.8a1.73 1.73 0 0 0-.18-.67 1.1 1.1 0 0 0-.44-.45 1.6 1.6 0 0 0-.78-.16c-.33 0-.6.06-.8.19-.2.12-.37.29-.48.5a2 2 0 0 0-.23.69c-.04.26-.06.52-.06.78v4.77H10.6v-4.8l-.01-.75a2.29 2.29 0 0 0-.14-.69c-.08-.2-.23-.38-.42-.5a1.5 1.5 0 0 0-.85-.2c-.15.01-.3.04-.44.08-.19.06-.37.15-.52.28-.18.14-.32.34-.44.6-.12.26-.18.6-.18 1.02v4.96H5.25V7.94h2.21ZM1.5 1.5v21h2.25V24H0V0h3.75v1.5H1.5Z"/></svg></a><a href="https://comentario.workaround.org/api/rss/comments?domain=0f111a27-fbfa-48af-8beb-ab12e612d92f" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Feed</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M2.88 16.88a3 3 0 0 0 0 4.24 3 3 0 0 0 4.24 0 3 3 0 0 0-4.24-4.24Zm2.83 2.83a1 1 0 0 1-1.42-1.42 1 1 0 0 1 1.42 0 1 1 0 0 1 0 1.42ZM5 12a1 1 0 0 0 0 2 5 5 0 0 1 5 5 1 1 0 0 0 2 0 7 7 0 0 0-7-7Zm0-4a1 1 0 0 0 0 2 9 9 0 0 1 9 9 1 1 0 0 0 2 0 11.08 11.08 0 0 0-3.22-7.78A11.08 11.08 0 0 0 5 8Zm10.61.39A15.11 15.11 0 0 0 5 4a1 1 0 0 0 0 2 13 13 0 0 1 13 13 1 1 0 0 0 2 0 15.11 15.11 0 0 0-4.39-10.61Z"/></svg></a> </div> <starlight-theme-select> <label style="--sl-select-width: 6.25em" class="astro-4yphtoen"> <span class="sr-only astro-4yphtoen">Select theme</span> <svg aria-hidden="true" class="icon label-icon astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg> <select autocomplete="off" class="astro-4yphtoen"> <option value="dark" class="astro-4yphtoen">Dark</option><option value="light" class="astro-4yphtoen">Light</option><option value="auto" selected class="astro-4yphtoen">Auto</option> </select> <svg aria-hidden="true" class="icon caret astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M17 9.17a1 1 0 0 0-1.41 0L12 12.71 8.46 9.17a1 1 0 1 0-1.41 1.42l4.24 4.24a1.002 1.002 0 0 0 1.42 0L17 10.59a1.002 1.002 0 0 0 0-1.42Z"/></svg> </label> </starlight-theme-select> <script>
|
||
StarlightThemeProvider.updatePickers();
|
||
</script> </div> </div> </div> </div> </nav> <div class="main-frame astro-vrdttmbt"> <script type="module">const a=document.getElementById("starlight__sidebar"),n=a?.querySelector("sl-sidebar-state-persist"),o="sl-sidebar-state",i=()=>{let t=[];const e=n?.dataset.hash||"";try{const s=sessionStorage.getItem(o),r=JSON.parse(s||"{}");Array.isArray(r.open)&&r.hash===e&&(t=r.open)}catch{}return{hash:e,open:t,scroll:a?.scrollTop||0}},c=t=>{try{sessionStorage.setItem(o,JSON.stringify(t))}catch{}},d=()=>c(i()),l=(t,e)=>{const s=i();s.open[e]=t,c(s)};n?.addEventListener("click",t=>{if(!(t.target instanceof Element))return;const e=t.target.closest("summary")?.closest("details");if(!e)return;const s=e.querySelector("sl-sidebar-restore"),r=parseInt(s?.dataset.index||"");isNaN(r)||l(!e.open,r)});addEventListener("visibilitychange",()=>{document.visibilityState==="hidden"&&d()});addEventListener("pageHide",d);</script> <div class="lg:sl-flex astro-67yu43on"> <aside class="right-sidebar-container print:hidden astro-67yu43on"> <div class="right-sidebar astro-67yu43on"> <div class="lg:sl-hidden astro-pb3aqygn"><mobile-starlight-toc data-min-h="2" data-max-h="3" class="astro-doynk5tl"><nav aria-labelledby="starlight__on-this-page--mobile" class="astro-doynk5tl"><details id="starlight__mobile-toc" class="astro-doynk5tl"><summary id="starlight__on-this-page--mobile" class="sl-flex astro-doynk5tl"><span class="toggle sl-flex astro-doynk5tl">On this page<svg aria-hidden="true" class="caret astro-doynk5tl astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg></span><span class="display-current astro-doynk5tl"></span></summary><div class="dropdown astro-doynk5tl"><ul class="isMobile astro-g2bywc46" style="--depth: 0;"> <li class="astro-g2bywc46" style="--depth: 0;"> <a href="#_top" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Overview</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#envelope-sender-or-visible-sender" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Envelope sender or visible sender?</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#spf" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">SPF</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#dkim" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">DKIM</span> </a> <ul class="isMobile astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#example" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Example</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#creating-a-keypair" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Creating a keypair</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#adding-the-public-key-to-a-dns-record" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Adding the public key to a DNS record</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#adding-the-private-key-to-rspamd" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Adding the private key to rspamd</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#enabling-dkim-maps-in-rspamd" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Enabling DKIM maps in rspamd</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#send-a-test-email" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Send a test email</span> </a> </li> </ul> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#dmarc" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">DMARC</span> </a> <ul class="isMobile astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#example-1" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Example</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#how-it-works" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">How it works</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#reporting" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Reporting</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#creating-a-record" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Creating a record</span> </a> </li> </ul> </li> </ul> </div></details></nav></mobile-starlight-toc><script type="module" src="/_astro/MobileTableOfContents.astro_astro_type_script_index_0_lang.C181hMzK.js"></script></div><div class="right-sidebar-panel sl-hidden lg:sl-block astro-pb3aqygn"><div class="sl-container astro-pb3aqygn"><starlight-toc data-min-h="2" data-max-h="3"><nav aria-labelledby="starlight__on-this-page"><h2 id="starlight__on-this-page">On this page</h2><ul class="astro-g2bywc46" style="--depth: 0;"> <li class="astro-g2bywc46" style="--depth: 0;"> <a href="#_top" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Overview</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#envelope-sender-or-visible-sender" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Envelope sender or visible sender?</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#spf" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">SPF</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#dkim" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">DKIM</span> </a> <ul class="astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#example" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Example</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#creating-a-keypair" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Creating a keypair</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#adding-the-public-key-to-a-dns-record" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Adding the public key to a DNS record</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#adding-the-private-key-to-rspamd" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Adding the private key to rspamd</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#enabling-dkim-maps-in-rspamd" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Enabling DKIM maps in rspamd</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#send-a-test-email" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Send a test email</span> </a> </li> </ul> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#dmarc" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">DMARC</span> </a> <ul class="astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#example-1" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Example</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#how-it-works" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">How it works</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#reporting" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Reporting</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#creating-a-record" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Creating a record</span> </a> </li> </ul> </li> </ul> </nav></starlight-toc><script type="module" src="/_astro/TableOfContents.astro_astro_type_script_index_0_lang.CKWWgpjV.js"></script></div></div> </div> </aside> <div class="main-pane astro-67yu43on"> <main data-pagefind-body class="astro-bguv2lll" lang="en" dir="ltr"> <div class="content-panel astro-7nkwcw3z"> <div class="sl-container astro-7nkwcw3z"> <h1 id="_top" class="astro-j6tvhyss">Prevent spoofing using DKIM and SPF</h1> </div> </div> <div class="content-panel astro-7nkwcw3z"> <div class="sl-container astro-7nkwcw3z"> <div class="sl-markdown-content"> <aside aria-label="Optional feature" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Optional feature </p> <div class="starlight-aside__content"> <p>This feature is completely optional. Just skip this page if you don’t care about villains sending emails in your name.</p> </div> </aside>
|
||
<p>Email sender spoofing means pretending to be in control of someone else’s email address. This is a common problem with
|
||
<a href="https://en.wikipedia.org/wiki/Phishing">phishing</a>. Often scammers send emails with a sender address of
|
||
<code dir="auto">something@paypal.com</code> and hope that the recipient falls for it and trusts them. SMTP does not care which sender address
|
||
you use. Most mail service providers enforce that you send emails only using your own email address. But some do not.
|
||
And bad guys obviously don’t care.</p>
|
||
<p>On this page I will help you set up the three common measures to prevent spoofing:</p>
|
||
<ul>
|
||
<li><a href="https://en.wikipedia.org/wiki/Sender_Policy_Framework">SPF</a> (<em>Sender Policy Framework</em>)</li>
|
||
<li><a href="https://en.wikipedia.org/wiki/DomainKeys">DKIM</a> (<em>DomainKeys Identified Mail</em>)</li>
|
||
<li><a href="https://en.wikipedia.org/wiki/DMARC">DMARC</a> (<em>Domain-based Message Authentication, Reporting and Conformance</em>)</li>
|
||
</ul>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="envelope-sender-or-visible-sender">Envelope sender or visible sender?</h2><a class="sl-anchor-link" href="#envelope-sender-or-visible-sender"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Envelope sender or visible sender?”</span></a></div>
|
||
<p>Each email that you receive actually contains two different sender addresses. Understanding the difference is important
|
||
when it comes to DKIM and DMARC.</p>
|
||
<p>The <strong>envelope sender</strong> is used by SMTP for delivery and bounce messages. It is <em>not</em> usually shown to the user. It
|
||
corresponds to the MAIL FROM command in SMTP. If during the transmission the sending server sent
|
||
<code dir="auto">MAIL FROM:<bounce@example.net></code> then this is the envelope sender. It will be added to the header part as
|
||
<code dir="auto">Return-Path: <bounce@example.net></code>. If you think of a written letter, then this is the sender which is written onto the
|
||
envelope. The postman will not look inside the envelope. So if the delivery fails, this is the address that the letter
|
||
will be sent back to as undeliverable.</p>
|
||
<p>The <strong>visible sender</strong> (this is not an official term) is what the recipient sees in their email software. In an actual
|
||
email this is the <code dir="auto">From: John <john@example.org></code> header. If you think of a written letter, then this is the sender as
|
||
found in the actual letter within the envelope.</p>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="spf">SPF</h2><a class="sl-anchor-link" href="#spf"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “SPF”</span></a></div>
|
||
<p>SPF defines which servers (IP addresses) are allowed to send emails on behalf of a specific domain.</p>
|
||
<p>SPF is essentially a TXT record in your DNS zone that provides machine-readable information for other mail servers. When
|
||
an email is received, the receiving server can (and usually does) check for an SPF record for your domain to determine
|
||
which IP addresses are authorized to send emails on its behalf.</p>
|
||
<p>Let’s take a look at a typical SPF record:</p>
|
||
<div class="expressive-code"><link rel="stylesheet" href="/_astro/ec.v4551.css"><script type="module" src="/_astro/ec.0vx5m.js"></script><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">"v=spf1 ip4:157.97.194.11 mx ~all"</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code=""v=spf1 ip4:157.97.194.11 mx ~all""><div></div></button></div></figure></div>
|
||
<p>What it means:</p>
|
||
<ol>
|
||
<li>this is an SPF record of version 1 of the standard (there is currently no other version)</li>
|
||
<li>please accept emails from the IP address 157.97.194.11</li>
|
||
<li>also accept emails from any server that is mentioned in our domain’s MX record (the server(s) that receive email for
|
||
your domain)</li>
|
||
<li>any other email should be considered suspicious – proceed with caution</li>
|
||
</ol>
|
||
<p>There are websites like <a href="https://easydmarc.com/tools/spf-record-generator">EasyDMARC</a> that help you create your SPF
|
||
string to add to your DNS domain. Keep in mind:</p>
|
||
<ul>
|
||
<li>You must know which mail servers send email from your domain. Do not forget to include mailing list or newsletter
|
||
services that send in your name.</li>
|
||
<li>Start with “~all” to mark emails as spam that do not meet the criteria. If all goes well switch to “-all” after a few
|
||
weeks.</li>
|
||
<li>Note that forwarding emails from your domain may break SPF because suddenly the email appears to be coming from an IP
|
||
address that is not authorized.</li>
|
||
</ul>
|
||
<p>Of course SPF not only helps other mail servers. Rspamd on your mail server will check for other domains’ SPF records,
|
||
too.</p>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="dkim">DKIM</h2><a class="sl-anchor-link" href="#dkim"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “DKIM”</span></a></div>
|
||
<p>DKIM can prove that an email has not been tampered with on its journey from the sender to the recipient.</p>
|
||
<p>DKIM uses <em>public key cryptography</em> to automatically add a <em>cryptographic signature</em> into the header of each outgoing
|
||
email. It also uses a TXT record in your domain’s DNS zone to publish the public key.</p>
|
||
<p>If you run the <em>sending</em> mail server, you need to:</p>
|
||
<ol>
|
||
<li>Create a <strong>public key</strong> and a <strong>private key</strong> for each domain.</li>
|
||
<li>Publish the <strong>public key</strong> through a DNS record of your domain. As only an administrator of the sending domain has
|
||
access to the DNS zone, this proves the authenticity.</li>
|
||
<li>Give your mail server the <strong>private key</strong> so it can <strong>sign</strong> all emails automatically.</li>
|
||
</ol>
|
||
<p>On the other hand the <em>receiving</em> mail server needs to:</p>
|
||
<ol>
|
||
<li>Check if there is a <strong>signature</strong> in an incoming email.</li>
|
||
<li>Fetch the <strong>public key</strong> from the DNS zone of the sending domain.</li>
|
||
<li>Make a cryptographic check if the <strong>signature</strong> matches the <strong>public key</strong>.</li>
|
||
</ol>
|
||
<p>I don’t want to dive deeper into public key cryptography. Take a look at the
|
||
<a href="https://en.wikipedia.org/wiki/Public-key_cryptography">Wikipedia article</a> for a decent explanation.</p>
|
||
<p>Obviously your mail server will both <em>receive</em> and <em>send</em> emails. So if you want to use DKIM (which I recommend) then
|
||
you need to take care of both parts. But luckily that’s not too hard. The <em>rspamd</em> software on your mail server can take
|
||
care of both signing outgoing emails and validating incoming signatures.</p>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="example">Example</h3><a class="sl-anchor-link" href="#example"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Example”</span></a></div>
|
||
<p>Let’s take a look at such a signature in real life. I have just sent an email from GMail to my personal email account on
|
||
my own mail server. Google uses DKIM signing so the email got this additional header from Google’s mail servers:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">d=gmail.com; s=20230601; t=1760017775; x=1760622575; darn=workaround.org;</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">h=to:subject:message-id:date:from:mime-version:from:to:cc:subject</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">:date:message-id:reply-to;</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">bh=HmztzLfHhgZON2788h5cwCX7liAbwFqnFGISA15M18Q=;</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">b=OKu5D/Ejp7tGy3uxydb7qDccK03OxrdD9vxEKiAXk/y9T5WViCqpg3HrdeB5Izkzdq</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">MXvQ+SgGVzJmy9ZgV1A930RRqUIoR2wmlr3GDXPDyRfagJMRV/3v9J71lfSduOFE8q7t</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">AIw4oWBm91QAnC5gW+XS7h4lNmRd4pVILkoe09qkLz+7WrU5Xp/WGIKHRK0ST5+EAR25…</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1760017775; x=1760622575; darn=workaround.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=HmztzLfHhgZON2788h5cwCX7liAbwFqnFGISA15M18Q=; b=OKu5D/Ejp7tGy3uxydb7qDccK03OxrdD9vxEKiAXk/y9T5WViCqpg3HrdeB5Izkzdq MXvQ+SgGVzJmy9ZgV1A930RRqUIoR2wmlr3GDXPDyRfagJMRV/3v9J71lfSduOFE8q7t AIw4oWBm91QAnC5gW+XS7h4lNmRd4pVILkoe09qkLz+7WrU5Xp/WGIKHRK0ST5+EAR25…"><div></div></button></div></figure></div>
|
||
<p>I need Google’s DKIM public key to verify that signature. It is stored in their DNS zone as a TXT record of
|
||
“<strong>20230601</strong>._domainkey.google.com”. The “<strong>20230601</strong>” is the key <em>selector</em> that is mentioned in the signature as
|
||
“s=<strong>20230601</strong>”. You can use multiple keys as long as you create the signatures with the matching private key. The
|
||
“_domainkey” part is the standard subdomain for DKIM keys. So let’s get that TXT record:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">dig</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">+short</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">20230601._domainkey.google.com</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">txt</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="dig +short 20230601._domainkey.google.com txt"><div></div></button></div></figure></div>
|
||
<p>This returns…</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4zd3nfUoLHWFbfoPZzAb8bvjsFIIFsNypweLuPe4M+vAP1YxObFxRnpvLYz7Z+bORKLber5aGmgFF9iaufsH1z0+aw8Qex7uDaafzWoJOM/6lAS5iI0JggZiUkqNpRQLL7H6E7HcvOMC61nJcO4r0PwLDZKwEaCs8gUHiqRn/SS3wqEZX29v/VOUVcI4BjaOz" "OCLaz7V8Bkwmj4Rqq4kaLQQrbfpjas1naScHTAmzULj0Rdp+L1vVyGitm+dd460PcTIG3Pn+FYrgQQo2fvnTcGiFFuMa8cpxgfH3rJztf1YFehLWwJWgeXTriuIyuxUabGdRQu7vh7GrObTsHmIHwIDAQAB"</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code=""v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4zd3nfUoLHWFbfoPZzAb8bvjsFIIFsNypweLuPe4M+vAP1YxObFxRnpvLYz7Z+bORKLber5aGmgFF9iaufsH1z0+aw8Qex7uDaafzWoJOM/6lAS5iI0JggZiUkqNpRQLL7H6E7HcvOMC61nJcO4r0PwLDZKwEaCs8gUHiqRn/SS3wqEZX29v/VOUVcI4BjaOz" "OCLaz7V8Bkwmj4Rqq4kaLQQrbfpjas1naScHTAmzULj0Rdp+L1vVyGitm+dd460PcTIG3Pn+FYrgQQo2fvnTcGiFFuMa8cpxgfH3rJztf1YFehLWwJWgeXTriuIyuxUabGdRQu7vh7GrObTsHmIHwIDAQAB""><div></div></button></div></figure></div>
|
||
<p>That is the public key that I can use to verify the signature. An automated check can be done using the
|
||
<code dir="auto">opendkim-testmsg</code> tool as described later. I can run it and paste the entire email including headers and body into it.
|
||
If it doesn’t complain with an error message then the signature is correct.</p>
|
||
<aside aria-label="Note" class="starlight-aside starlight-aside--note"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M12 11a1 1 0 0 0-1 1v4a1 1 0 0 0 2 0v-4a1 1 0 0 0-1-1Zm.38-3.92a1 1 0 0 0-.76 0 1 1 0 0 0-.33.21 1.15 1.15 0 0 0-.21.33 1 1 0 0 0 .21 1.09c.097.088.209.16.33.21A1 1 0 0 0 13 8a1.05 1.05 0 0 0-.29-.71 1 1 0 0 0-.33-.21ZM12 2a10 10 0 1 0 0 20 10 10 0 0 0 0-20Zm0 18a8 8 0 1 1 0-16.001A8 8 0 0 1 12 20Z"/></svg>Note </p> <div class="starlight-aside__content"> <p>The signature does <strong>not</strong> certify the domain of the sender. In this example the signature is for <code dir="auto">d=gmail.com</code>. But it
|
||
could also have been <code dir="auto">d=abc.xyz</code>. A DKIM signature just says:</p><p><em>This email has been sent by a mail server that has the key for the <code dir="auto">gmail.com</code> domain. And it has not been tampered
|
||
with on its way to you.</em></p><p>So it is <strong>not</strong> about the authenticity of the person who sent it to you. Of course it makes sense that the signature
|
||
matches the domain of the sending user. Enforcing that will be a job for DMARC which is explained later on this page.</p> </div> </aside>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="creating-a-keypair">Creating a keypair</h3><a class="sl-anchor-link" href="#creating-a-keypair"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Creating a keypair”</span></a></div>
|
||
<p>Sounds good? Then let’s implement that for your email domains, too.</p>
|
||
<p>If you have skipped the previous section on detecting and filtering out spam emails, then just run these two commands to
|
||
tell Postfix to send all emails through rspamd:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_milters=inet:127.0.0.1:11332</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">non_smtpd_milters=inet:127.0.0.1:11332</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="postconf smtpd_milters=inet:127.0.0.1:11332postconf non_smtpd_milters=inet:127.0.0.1:11332"><div></div></button></div></figure></div>
|
||
<p>As explained above you need a <strong>private key</strong> that your mail server will use for signing and a <strong>public key</strong> that gets
|
||
added to your DNS zone.</p>
|
||
<p>If you put your key file into /var/lib/rspamd/dkim/ using a certain naming scheme, <code dir="auto">rspamd</code> will pick it up
|
||
automatically:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server – but use your own domain here</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Create the directory</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">mkdir</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/var/lib/rspamd/dkim</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Fix permissions</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">chown</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">_rspamd:_rspamd</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/var/lib/rspamd/dkim</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Create a new keypair (use your own domain here)</span></div></div><div class="ec-line"><div class="code"><span style="--0:#C5E478;--1:#3B61B0">cd</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/var/lib/rspamd/dkim</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">rspamadm</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">dkim_keygen</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-d</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-s</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">2025100901</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="# Create the directorymkdir /var/lib/rspamd/dkim# Fix permissionschown _rspamd:_rspamd /var/lib/rspamd/dkim# Create a new keypair (use your own domain here)cd /var/lib/rspamd/dkimrspamadm dkim_keygen -d example.org -s 2025100901"><div></div></button></div></figure></div>
|
||
<p>The <strong>selector</strong> (-s) I chose is <strong>2025100901</strong> because that’s the day I created it. The first (01) key on 2025-10-09.
|
||
It doesn’t matter though – you can name it anything you want. If you are lazy and unconcerned you could even use “dkim”
|
||
as the selector and later save some work by not needing DKIM maps that define which key is supposed to be used for each
|
||
domain. “dkim” is the default selector if you do not use maps. But some day you may want to add new keys so I recommend
|
||
you stay flexible and use a custom selector.</p>
|
||
<p>The output will contain you both the private key…</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">-----BEGIN PRIVATE KEY-----</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALhyevPohneucRGQ</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">LXgqtajXhDgOr9kvoX5igRuChC+j7Fxvwh4SuUphMKLynabAvcUUF951BgVB4PXU</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Qoxae7cEkjWATNSiv+Eq0w+AKErdC+BFNDSTk74GZDBBhlroxyudk7QMCZ2nhiOA</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">/rY1LypaDQzBiRSV8zjcHC8E2Z5lAgMBAAECgYEAodSn9isVGBrwz8Udb+qhOoPl</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">WT3hogA9hGMu/hEUo6wCrNPNkI9DDXSatM2D7xP7LNhFXQR2BNTZaTcUMIsPMXZ9</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">157tBVUAcnoRES6BbPyKC7k4dgSXxh687jhSgQWy+OZIU8IbJcoDXXsGjx+6Sb4W</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Ilo9NMCF/QqxRFIne70CQQDhNC4YasFOdJyWACxIbFBt+/HhO5+UboUIrZU5nde7</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">N5HEfnP3Ow2C6vdNnGWiv4YpobN7zjz+lFj19rlWvmHDAkEA0auDQVfIiLEUrKvW</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">TdhbscpEoYHP+AlM48C+QltKVk+eAnJJHNbBYMVmCmXafgMzFh8QhgG5WXKSlvtz</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">G/+UtwJAS4QL0PQ7TeucdlAoiUCI19icC0LLCCLnSTmryF49cPH5V0Jv8H9E0Jmp</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">w8Sl8CT5AAzQ+rr1iQiFrDTHgWblsQJBAJGEtSMrts1QAaZZ2PHMQM+jL4DcZKek</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">ZM4JXsMVMwG2XlcaVK4EStBMEKcUy9D7jYBD7SbkmWyAPUc2m0yKVP8CQB1zxjA0</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Z700vkWGKhwY4DznuDGjpU9rvQw7pyCJ3TYDT3ACQePmGmVeCtyETJ5XvFV2jSqf</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">o9J+GsdbljSnnSw=</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">-----END PRIVATE KEY-----</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="-----BEGIN PRIVATE KEY-----MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALhyevPohneucRGQLXgqtajXhDgOr9kvoX5igRuChC+j7Fxvwh4SuUphMKLynabAvcUUF951BgVB4PXUQoxae7cEkjWATNSiv+Eq0w+AKErdC+BFNDSTk74GZDBBhlroxyudk7QMCZ2nhiOA/rY1LypaDQzBiRSV8zjcHC8E2Z5lAgMBAAECgYEAodSn9isVGBrwz8Udb+qhOoPlWT3hogA9hGMu/hEUo6wCrNPNkI9DDXSatM2D7xP7LNhFXQR2BNTZaTcUMIsPMXZ9157tBVUAcnoRES6BbPyKC7k4dgSXxh687jhSgQWy+OZIU8IbJcoDXXsGjx+6Sb4WIlo9NMCF/QqxRFIne70CQQDhNC4YasFOdJyWACxIbFBt+/HhO5+UboUIrZU5nde7N5HEfnP3Ow2C6vdNnGWiv4YpobN7zjz+lFj19rlWvmHDAkEA0auDQVfIiLEUrKvWTdhbscpEoYHP+AlM48C+QltKVk+eAnJJHNbBYMVmCmXafgMzFh8QhgG5WXKSlvtzG/+UtwJAS4QL0PQ7TeucdlAoiUCI19icC0LLCCLnSTmryF49cPH5V0Jv8H9E0Jmpw8Sl8CT5AAzQ+rr1iQiFrDTHgWblsQJBAJGEtSMrts1QAaZZ2PHMQM+jL4DcZKekZM4JXsMVMwG2XlcaVK4EStBMEKcUy9D7jYBD7SbkmWyAPUc2m0yKVP8CQB1zxjA0Z700vkWGKhwY4DznuDGjpU9rvQw7pyCJ3TYDT3ACQePmGmVeCtyETJ5XvFV2jSqfo9J+GsdbljSnnSw=-----END PRIVATE KEY-----"><div></div></button></div></figure></div>
|
||
<p>…and the public key – in the format of a DNS record:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025100901._domainkey IN TXT ( "v=DKIM1; k=rsa;"</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ) ;</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="2025100901._domainkey IN TXT ( "v=DKIM1; k=rsa;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ) ;"><div></div></button></div></figure></div>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="adding-the-public-key-to-a-dns-record">Adding the public key to a DNS record</h3><a class="sl-anchor-link" href="#adding-the-public-key-to-a-dns-record"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Adding the public key to a DNS record”</span></a></div>
|
||
<p>Before you start signing your emails you must make sure that the public key is properly present in your DNS zone for the
|
||
domain you are sending emails from. Otherwise the recipient will be unable to verify the signature and may incorrectly
|
||
assume that the email was spoofed.</p>
|
||
<p>Take a look at the TXT record. It will look something like this:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2019122401._domainkey IN TXT v=DKIM1; k=rsa;</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="2019122401._domainkey IN TXT v=DKIM1; k=rsa;"><div></div></button></div></figure></div>
|
||
<p>If you are running your own DNS server you should be able to copy this entire file and put it into your DNS zone.
|
||
However if your internet provider offers you just a web interface to manage your domains then create a new TXT record
|
||
with a host name of “<strong>2019122401</strong>._domainkey” in your domain and put the string within the double-quotes into it as
|
||
the value. In my example:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025100901._domainkey IN TXT ( "v=DKIM1; k=rsa;"</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ) ;</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="2025100901._domainkey IN TXT ( "v=DKIM1; k=rsa;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ) ;"><div></div></button></div></figure></div>
|
||
<p>Be aware that the string you got contains two strings ”…” + ”…” that must be merged into one to work. If you are running
|
||
your own name server with <code dir="auto">bind</code> then you can just take that record as is. Other software or your favorite DNS provider
|
||
may expect a different syntax. In the end the value of the TXT record needs to be one long string. You can use <em>dig</em> to
|
||
verify that:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">dig</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">+short</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">2025100901._domainkey.example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">txt</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="dig +short 2025100901._domainkey.example.org txt"><div></div></button></div></figure></div>
|
||
<p>If you get the TXT entry like as follows then you are ready to enable DKIM signing in rspamd for that domain:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB"</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code=""p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB""><div></div></button></div></figure></div>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="adding-the-private-key-to-rspamd">Adding the private key to rspamd</h3><a class="sl-anchor-link" href="#adding-the-private-key-to-rspamd"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Adding the private key to rspamd”</span></a></div>
|
||
<p>Take the private key that was created earlier (the multi-line string including “<code dir="auto">…BEGIN PRIVATE KEY…</code>” and
|
||
“<code dir="auto">…END PRIVATE KEY…</code>”) and put it into a file at the location where rspamd will look for it:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">/var/lib/rspamd/dkim/example.org.2025100901.key</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="/var/lib/rspamd/dkim/example.org.2025100901.key"><div></div></button></div></figure></div>
|
||
<p>The name of the file has to be DOMAIN + dot + SELECTOR + “.key” like above. If you name the file incorrectly you will
|
||
get an error in your rspamd.log file like “<em>lua_dkim_sign_handler: cannot load dkim key
|
||
/var/lib/rspamd/dkim/example.org.dkim.key</em>”.</p>
|
||
<p>Make sure that only the <code dir="auto">_rspamd</code> user can read it:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">chown</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">_rspamd</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/var/lib/rspamd/dkim/</span><span style="--0:#7FDBCA;--1:#096E72">*</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">chmod</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">u=r,go=</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/var/lib/rspamd/dkim/</span><span style="--0:#7FDBCA;--1:#096E72">*</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="chown _rspamd /var/lib/rspamd/dkim/*chmod u=r,go= /var/lib/rspamd/dkim/*"><div></div></button></div></figure></div>
|
||
<p>rspamd will automatically pick up the files and does not need to be restarted when you add new keys for further domains.</p>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="enabling-dkim-maps-in-rspamd">Enabling DKIM maps in rspamd</h3><a class="sl-anchor-link" href="#enabling-dkim-maps-in-rspamd"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Enabling DKIM maps in rspamd”</span></a></div>
|
||
<p>As explained above it is advised to use DKIM <strong>maps</strong>. It’s nothing fancy. Just a simple file defining which selector
|
||
you want to use for signing for a certain domain. rspamd will assume that your selector is always <code dir="auto">dkim</code> unless
|
||
specified otherwise in a map. Always use a specific selector so that you can later add new keys to DNS without getting
|
||
into trouble.</p>
|
||
<p>Using maps is simple. First we need to change the <em>selector_map</em> setting of the dkim_signing module. Create a new rspamd
|
||
configuration file:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Tell rspamd to look up selectors in our mapping file</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">cat</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72">></span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/etc/rspamd/local.d/dkim_signing.conf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72"><<</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">'EOF'</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#984E4D">path = "/var/lib/rspamd/dkim/$domain.$selector.key";</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#984E4D">selector_map = "/etc/rspamd/dkim_selectors.map";</span></div></div><div class="ec-line"><div class="code"><span style="--0:#D9F5DD;--1:#111111">EOF</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Restart rspamd</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">systemctl</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">restart</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">rspamd</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="# Tell rspamd to look up selectors in our mapping filecat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF'path = "/var/lib/rspamd/dkim/$domain.$selector.key";selector_map = "/etc/rspamd/dkim_selectors.map";EOF# Restart rspamdsystemctl restart rspamd"><div></div></button></div></figure></div>
|
||
<p>The configuration is simple. rspamd will look for the domain-to-key mapping in the <code dir="auto">dkim_selectors.map</code> file. Create
|
||
that file for your own domain and selector:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Add the mapping of domain/selector (use your own domain here)</span></div></div><div class="ec-line"><div class="code"><span style="--0:#C5E478;--1:#3B61B0">echo</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">2025100901</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72">></span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/etc/rspamd/dkim_selectors.map</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="# Add the mapping of domain/selector (use your own domain here)echo example.org 2025100901 > /etc/rspamd/dkim_selectors.map"><div></div></button></div></figure></div>
|
||
<p>That’s all. rspamd now knows that whenever it sees an outgoing email from <code dir="auto">anyone@example.org</code> it will get the DKIM
|
||
private key from /var/lib/rspamd/dkim/<strong>example.org</strong>.<strong>2025100901</strong>.key and use it to sign the email.</p>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="send-a-test-email">Send a test email</h3><a class="sl-anchor-link" href="#send-a-test-email"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Send a test email”</span></a></div>
|
||
<p>You could either just send an email from your mail client (or Roundcube) through your mail server to another email
|
||
address. Or you could use swaks. Use your own addresses and password of course:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:587</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">some.address@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">some.external.address@example.net</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">-tls</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-user</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">some.address@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-password</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">your_secreet_password</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:587 \ --from some.address@example.org \ --to some.external.address@example.net \ -tls \ --auth-user some.address@example.org \ --auth-password your_secreet_password"><div></div></button></div></figure></div>
|
||
<p>If you take a look at the received email it should have a DKIM header now like:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.org; s=2019122401; t=1519400838</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">h=from:subject:date:message-id:to:mime-version:content-type:content-transfer-encoding;</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">bh=kpYel1IlDvqXEUc0SyIpXbMte3XpQOCXHl+zTyHQvGc=; b=NEUyWUoeKE…</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.org; s=2019122401; t=1519400838h=from:subject:date:message-id:to:mime-version:content-type:content-transfer-encoding;bh=kpYel1IlDvqXEUc0SyIpXbMte3XpQOCXHl+zTyHQvGc=; b=NEUyWUoeKE…"><div></div></button></div></figure></div>
|
||
<p>To verify the signature install the <em>opendkim-tools</em> package, copy the entire test email (including headers and body),
|
||
run <em>opendkim-testmsg</em> in your shell and paste the email (finish with CTRL-D).</p>
|
||
<p>If you get no output then the signature verified correctly. But if you get something like “opendkim-testmsg: dkim_eom():
|
||
Unable to verify” then double-check your DNS record.</p>
|
||
<p>You can also use websites like <a href="http://dkimvalidator.com/">dkimvalidator.com</a> or
|
||
<a href="https://www.mail-tester.com/">mail-tester.com</a> to verify that your signatures are working well.</p>
|
||
<details class="collapsible"><summary>Click here if you do not get a DKIM signature…</summary><p>Enable logging:</p><div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">cat</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72">></span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/etc/rspamd/local.d/logging.inc</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72"><<</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">'EOF'</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#984E4D">debug_modules = ["dkim", "dkim_signing"];</span></div></div><div class="ec-line"><div class="code"><span style="--0:#D9F5DD;--1:#111111">EOF</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">systemctl</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">restart</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">rspamd</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">tail</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-f</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/var/log/rspamd/rspamd.log</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="cat > /etc/rspamd/local.d/logging.inc << 'EOF'debug_modules = ["dkim", "dkim_signing"];EOFsystemctl restart rspamdtail -f /var/log/rspamd/rspamd.log"><div></div></button></div></figure></div><p>Look for any errors. And check that the correct key from <code dir="auto">/var/lib/rspamd/dkim</code> is chosen and used. This is what it
|
||
should look like:</p><div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:185: user is authenticated</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:407: use domain(header) for signature: example.org</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:427: final DKIM domain: example.org</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:48: add selector "2025100901" using selector_map</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:53: set key to "/var/lib/rspamd/dkim/$domain.$selector.key" using default path</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:53: set domain to "example.org" using dkim_domain</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; dkim_signing.lua:130: using key "/var/lib/rspamd/dkim/example.org.2025100901.key", use selector "2025100901" for domain "example.org"</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:185: user is authenticated2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:407: use domain(header) for signature: example.org2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:427: final DKIM domain: example.org2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:48: add selector "2025100901" using selector_map2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:53: set key to "/var/lib/rspamd/dkim/$domain.$selector.key" using default path2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; lua_dkim_tools.lua:53: set domain to "example.org" using dkim_domain2025-10-19 10:23:40 #1806716(normal) <ec2f11>; dkim_signing; dkim_signing.lua:130: using key "/var/lib/rspamd/dkim/example.org.2025100901.key", use selector "2025100901" for domain "example.org""><div></div></button></div></figure></div><p>One caveat is the handling of <em>subdomains</em>. <code dir="auto">example.org</code> is a second-level domain. But you may want to use
|
||
<code dir="auto">service.example.org</code> for your domain. That’s totally fine. But rspamd will strip it down to <code dir="auto">example.org</code> and use the
|
||
DKIM key for <code dir="auto">example.org</code>. If that’s not what you want, then add this line to <code dir="auto">/etc/rspamd/local.d/dkim_signing.conf</code>:</p><div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">use_esld = false;</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="use_esld = false;"><div></div></button></div></figure></div><p><strong>eSLD</strong> is a rarely used acronym that stands for <em>effective second-level domain</em>. In layman’s terms: the part of a
|
||
domain that only consists of the rightmost two parts. For <code dir="auto">mails.hawkeye.example.com</code> the eSLD is <code dir="auto">example.com</code>.</p></details>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="dmarc">DMARC</h2><a class="sl-anchor-link" href="#dmarc"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “DMARC”</span></a></div>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="example-1">Example</h3><a class="sl-anchor-link" href="#example-1"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Example”</span></a></div>
|
||
<p>Let’s take an example header of a spoofed mail:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Return-Path: <noreply@evil-spammer.com></span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">DKIM-Signature: d=evil-spammer.com</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">From: <service@paypal.com></span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="Return-Path: <noreply@evil-spammer.com>DKIM-Signature: d=evil-spammer.comFrom: <service@paypal.com>"><div></div></button></div></figure></div>
|
||
<p>In this example a bad guy just sent you this email. The SPF check for the <code dir="auto">evil-spammer.com</code> domain was successful. (You
|
||
can’t see that from these headers though.) He even added a DKIM signature from his domain. So everything looks right.
|
||
But in your mail program you see <code dir="auto">service@paypal.com</code>. So nobody checks that the <em>envelop sender</em> and the <em>visible
|
||
sender</em> “align”.</p>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="how-it-works">How it works</h3><a class="sl-anchor-link" href="#how-it-works"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “How it works”</span></a></div>
|
||
<p>That’s what DMARC is supposed to solve. It works like this:</p>
|
||
<ul>
|
||
<li>(A) SPF
|
||
<ul>
|
||
<li>Run a normal <strong>SPF</strong> check (on the <em>envelope sender</em>’s domain as usual)</li>
|
||
<li>Make sure that the domain of this <em>envelope sender</em> <strong>aligns</strong> with (matches) the domain of the <em>visible sender</em></li>
|
||
</ul>
|
||
</li>
|
||
<li>(B) DKIM
|
||
<ul>
|
||
<li>Look for a valid <strong>DKIM</strong> signature (also of the <em>envelope sender</em>’s domain)</li>
|
||
<li>Make sure that the domain of the <em>envelope sender</em> <strong>aligns</strong> with (matches) the domain of the <em>visible sender</em></li>
|
||
</ul>
|
||
</li>
|
||
<li>Make sure that <strong>at least one</strong> of (A) or (B) are true</li>
|
||
</ul>
|
||
<p>There are also two flavors of that <em>alignment</em>:</p>
|
||
<ul>
|
||
<li><strong>strict</strong> means that the domains need to match exactly</li>
|
||
<li><strong>relaxed</strong> means that it can be a subdomain</li>
|
||
</ul>
|
||
<p>You can find more examples about the <em>alignment</em> in the <a href="https://www.ietf.org/rfc/rfc7489.txt">RFC 7489</a> in Appendix
|
||
B.1.</p>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="reporting">Reporting</h3><a class="sl-anchor-link" href="#reporting"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Reporting”</span></a></div>
|
||
<p>Another feature of DMARC is reporting. You may want to know whether your emails had delivery problems. DMARC has two
|
||
tags for that purpose:</p>
|
||
<ul>
|
||
<li><strong>ruf</strong> stands for “<strong>R</strong>eporting <strong>U</strong>RI for <strong>F</strong>ailure data”. The email address you use in the “ruf” tag will get
|
||
machine-readable information on every mail that failed the DMARC test. If the receiving mail server supports DMARC, it
|
||
<strong>may</strong> automatically generate and send that email to this address. However most internet providers just ignore “ruf”
|
||
because it contains sensible information on email addresses.</li>
|
||
<li><strong>rua</strong> stands for “<strong>R</strong>eporting <strong>U</strong>RI for <strong>A</strong>ggregated data”. The email address you use in the “rua” tag will
|
||
get statistical data usually once a day. If you want to know if your emails deliver properly, you can use this.</li>
|
||
</ul>
|
||
<p>There are commercial offers that allow you to point your “rua” record to their service and show you human-readable
|
||
information. Or you can use the tools <code dir="auto">dmarc-cat</code> or <code dir="auto">dmarcts-report-parser</code> that can be installed as Debian packages on
|
||
your system.</p>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="creating-a-record">Creating a record</h3><a class="sl-anchor-link" href="#creating-a-record"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Creating a record”</span></a></div>
|
||
<p>If you want to use DMARC (and I suggest that you do), just add a DNS record to your domain. These web sites help you
|
||
craft a valid record:</p>
|
||
<ul>
|
||
<li><a href="http://www.kitterman.com/dmarc/assistant.html">http://www.kitterman.com/dmarc/assistant.html</a></li>
|
||
<li><a href="https://dmarcian.com/dmarc-inspector/">https://dmarcian.com/dmarc-inspector/</a></li>
|
||
<li><a href="https://www.unlocktheinbox.com/dmarcwizard/">https://www.unlocktheinbox.com/dmarcwizard/</a></li>
|
||
<li><a href="https://www.agari.com/resources/tools/dmarc">https://www.agari.com/resources/tools/dmarc</a></li>
|
||
</ul>
|
||
<p>Please note that the DMARC record is a TXT record like <code dir="auto">_dmarc.example.com</code>. That <code dir="auto">_dmarc</code> host name is important.</p> </div> <footer> <footer class="sl-flex astro-3yyafb3n"> <div class="meta sl-flex astro-3yyafb3n"> <p>Last updated: <time datetime="2025-11-01T00:00:00.000Z">Nov 1, 2025</time></p> </div> <div class="pagination-links print:hidden astro-u2l5gyhi" dir="ltr"> <a href="/ispmail-trixie/catching-spam-with-rspamd/" rel="prev" class="astro-u2l5gyhi"> <svg aria-hidden="true" class="astro-u2l5gyhi astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.5rem;"><path d="M17 11H9.41l3.3-3.29a1.004 1.004 0 1 0-1.42-1.42l-5 5a1 1 0 0 0-.21.33 1 1 0 0 0 0 .76 1 1 0 0 0 .21.33l5 5a1.002 1.002 0 0 0 1.639-.325 1 1 0 0 0-.219-1.095L9.41 13H17a1 1 0 0 0 0-2Z"/></svg> <span class="astro-u2l5gyhi"> Previous <br class="astro-u2l5gyhi"> <span class="link-title astro-u2l5gyhi">Catching spam with rspamd</span> </span> </a> <a href="/ispmail-trixie/catch-all/" rel="next" class="astro-u2l5gyhi"> <svg aria-hidden="true" class="astro-u2l5gyhi astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.5rem;"><path d="M17.92 11.62a1.001 1.001 0 0 0-.21-.33l-5-5a1.003 1.003 0 1 0-1.42 1.42l3.3 3.29H7a1 1 0 0 0 0 2h7.59l-3.3 3.29a1.002 1.002 0 0 0 .325 1.639 1 1 0 0 0 1.095-.219l5-5a1 1 0 0 0 .21-.33 1 1 0 0 0 0-.76Z"/></svg> <span class="astro-u2l5gyhi"> Next <br class="astro-u2l5gyhi"> <span class="link-title astro-u2l5gyhi">Catch-all addresses</span> </span> </a> </div> </footer> <script defer src="https://comentario.workaround.org/comentario.js"></script>
|
||
<comentario-comments no-fonts="true" id="comments"></comentario-comments> <div class="myfooter">
|
||
This guide is maintained by <a href="mailto:ispmail@christoph-haas.de">Christoph Haas</a> since 2003. All content on workaround.org can be used under the terms of
|
||
the
|
||
<a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">Creative Commons BY-NC-SA license</a>.
|
||
Penguin image based on AI art because I suck at drawing.
|
||
</div> </footer> </div> </div> </main> </div> </div> </div> </div> </body></html> |