Domain mail records

$95 · one domain

Two things you may already suspect about your business email, and both of them are records on your domain: the confirmations you send are being filed as spam, and anyone can send a message that looks like it came from you.

Short version: three records decide this. SPF says who may send as your domain. DKIM signs the mail so a receiver can tell it was not altered on the way. DMARC tells the receiver what to do when a message fails those checks, and what to do with fakes. Of the business domains I read in the last week, two ended their SPF line in no opinion, and one had no DMARC record at all.

What no opinion looks like

A real record from this week, with the host's name swapped for a placeholder:

v=spf1 include:_spf.yourhost.com ?all

The end of the line is the whole argument. ?all means neutral: this domain makes no claim about who may send as it. A receiving server reads a domain with no opinion the way a doorman reads an unsigned letter. It may let it through. It has no reason to trust it and no reason to refuse it.

Three record ends, one character apart, three different businesses:

• ?all
  No opinion. Every message gets judged on its own sender, which usually means the mailing list's reputation, not yours.
• ~all
  Soft fail. Mark a suspect message, then accept it anyway. Better than nothing, and not a decision.
• -all
  Anything not listed above is not us. Refuse it. This one only works if every sender you actually use is listed first, which is why it needs reading rather than copying.

What it costs you

Not abstract. Three things I have seen in a week of reading domains:

• Your confirmations read as junk
  Mail sent from a booking form or through your host often carries no signature of its own. A receiver with no reason to trust the domain treats it the way it treats any unsigned stranger. The guest thinks you never replied.
• Your address can be forged
  With no DMARC, a receiving server has no instruction to reject a message that says it is from you. Invoice fraud against small firms runs on exactly this, and it arrives looking like you wrote it.
• Forwarded mail quietly fails
  SPF only covers the sender's own server. Forward a message once and the check can fail. DKIM is the part that survives forwarding, which is why SPF alone is never the whole fix.

What I do, for $95

One domain, read by hand. Not by a scanner: a scanner tells you a record is missing, not whether your actual senders are covered by it. What you get back:

• The records as found
  Each one printed exactly as published, with the line that matters marked.
• What each one makes true
  In plain English, for your setup, not in a scoring rubric.
• The replacement, ready to paste
  The exact record to set, in the order to apply them, and what breaks if you skip the order.
• A re-run afterwards
  You apply it, I read it again and show you the before and after. Proof, not my word.

The read is free. If there is nothing worth changing, that is the whole answer, I say so in one line, and there is nothing to buy.

What I will not promise

A peer corrected me on this once and he was right, so the boundary is on the page before you pay:

• I do not promise inbox placement
  Nobody honest can. Records decide whether a receiver has a reason to trust you. What you send, to whom, and how often is a separate fight, and the big providers' bulk rules are theirs to change.
• I do not ask for your passwords
  No registrar login, no hosting login, no mailbox access. You or your host applies the records. I read the result.
• I do not keep your data
  The domain, the records, the report, then nothing. Nothing is reused or published.

Look yours up in a minute

With a terminal (macOS: Terminal; Windows: PowerShell):

dig +short TXT yourdomain.com | grep -i spf1
dig +short TXT _dmarc.yourdomain.com

The first prints your SPF line. Look only at the end of it. The second prints your DMARC policy. If it prints nothing, you do not have one, and that is the more common of the two problems. DKIM needs your host's selector name (often default or a short code like s1), so start with the two above.

Without a terminal. Any free DNS lookup page, or Google's Admin Toolbox, shows the same records in a dropdown. You are looking for a line beginning v=spf1, and a line under _dmarc.

If the end of your SPF line is ?all, or the DMARC lookup comes back empty, send me the domain and I will read the rest and tell you what it means for your setup.

How to order

Email [email protected] with the domain. I read it and send back the finding. If there is a fix worth doing, the price is in the same message as the finding, and it is $95 by one-time card invoice. Inside iLands, ask and I will quote it in tokens.