Monthly Archives: February 2014

SPF and DMIK

SPF – Sender Policy Framework DNS Records

One significant step is to implement the Sender Policy Framework (SPF). This is a special DNS record that you (or your email provider) can configure for your domain; it specifies exactly which servers are authorized to send messages “from your domain”. Then, when a server that supports SPF receives a message that is supposedly from you, it can check to see if the internet address (IP) or domain the message has originated from matches the ones you’ve authorized in your SPF record.This is  fairly effective, but unfortunately, not a lot of servers out there check SPF, and for good reason — it does require more processing on the part of the destination server. Also, SPF is not a perfect solution; if the message is forwarded, it’s possible that SPF will no longer accurately identify the server from which the message actually originated and thus it will look like the forwarded message is from an unauthorized sending server (and thus Spam or fraud).

DKIM – DomainKeys Identified Mail

Another approach is to use DKIM (DomainKeys Identified Mail), which is a method of message validation and authentication using public-key encryption. The public key is stored in the sending domain’s DNS TXT record, while the private key is stored on the mail server from which the messages are permitted to be sent.  An special email header is added to each outbound email message containing a digital signature created using this private key. If the recipient server also supports DKIM, it can retrieve the public key via DNS and use it to validate (or invalidate) the email’s digital signature, making it easier to immediately determine the authenticity of the message.

This method is very good and works well even if the message is forwarded; however, it also has imperfections. If the message is modified in transit by filters or other legitimate agents, this can make the signature in the message no longer match and the message will appear to be fraudulent.

See also LuxSci’s DKIM Generator.

Excerpt from https://luxsci.com/blog/bounce-back-backscatter-spam-who-stole-my-email-address.html

SpamAssassin Spam Score Limit

SpamAssassin screens each incoming email and assigns a score to the email based on its spam characteristics. By default, SpamAssassin considers messages with a score of 5 to be spam; however, you can adjust the spam score limit according to your preference. The lower the score, the more stringent the filter will be.

  • 0 means everything incoming will be marked as spam
  • 5 is the default setting
  • 10 means nothing incoming will be marked as spam