How to Add DMARC, DKIM, SFP to Avoid Email Spoofing

Mandrill is most commonly used Transactional Email Service. They are easy to add with just few PHP snippets, like we gave snippets or tutorials for using WordPress with Mandrill or XenForo with Mandrill. Commonly, Transactional Email Services Like Mandrill is used With Google Apps. Here is How to Add DMARC, DKIM, SFP to Avoid Email Spoofing. Mandrill infamously mark with Poor Account Reputation. Although, Poor Account Reputation is a deliberate work done by Mandrill, DMARC, DKIM, SFP avoids Email Spoofing and for Free Mandrill like transactional email service with a shared IP, it is quite important.

What We Need to Know Before Jumping to Ask How to Add DMARC, DKIM, SFP to Avoid Email Spoofing

IP Spoofing was discussed before. There is also DNS Spoofing. Most of these Cloud Transactional Email Services are smaller business has no own datacenter or DNS. It is unlikely that they use Dyn like good DNS provider.
We talked about SFP before.

If you are using Google Mail for Domains (old name of Google Apps) or Zoho Mail with any Cloud Transactional Email Service, you must be careful and add all these records.

DKIM means DomainKeys Identified Mail, which is an email authentication method to detect email spoofing through cryptographic authentication. DMARC is Domain-based Message Authetication, Reporting, and Conformance. You’ll receive daily emails by Google Apps and/or Transactional Email Service as tar ball.

How to Add DMARC, DKIM, SFP to Avoid Email Spoofing

We are setting these records via DNS Service Provider as TXT record.

SPF for Google Mail for Domains (Google Apps) Plus Mandrill

Run this command for our website on Terminal or iTerm2 window :

You’ll get this result :

That v=spf1 is common, include:spf.mandrillapp.com is for Mandrill, include:_spf.google.com is for Google, ~all is a flag. You can blindly use the same like that of us if you are using Google Mail for Domains (Google Apps) Plus Mandrill. SPF follows this RFC :

DKIM for Google Mail for Domains (Google Apps) Plus Mandrill

In the same way, run this command :

You’ll get a big response :

Notice that dig was for mandrill._domainkey.thecustomizewindows.com. Now, run this :

You’ll get a big response :

No, the value are not same. There is IQ inside, run :

there will be no return. But, if you run :

there will be IQ highlighted.

Notice that dig was for google._domainkey.thecustomizewindows.com. For Google Apps, at this moment, the URL to directly get that DKIM is :

It is mandatory to combine SFP record from multiple providers like Mandrill, Google Apps when both are used by the domain in the way we have shown. DKIM needs not to combines or rather not possible.

DKIM is spelled on RFC 4871 :

DMARC for Google Mail for Domains (Google Apps) Plus Mandrill

DMARC is most difficult. No Mail Service Provider will auto generate DMARC for you, unlike SPF and DKIM. Above two were copy && paste work. Run :

You’ll get this response :

What those words mean in v=DMARC1\; p=none\; pct=100\; rua=mailto:webmaster@thecustomizewindows.com\; ruf=mailto:admin@thecustomizewindows.com\; is nicely written in RFC elaborately. Basically like for hyperlinks, bots understand rel="nofollow" and rel="no_follow" both, pct=100 automatically may get adjusted by function to 90%.

Here is a genuine DMARC report of our this website sent by Google – https://gist.github.com/AbhishekGhosh/10e3122bff346af62ae4

You’ll get human usable tools here – https://dmarc.org/resources/deployment-tools/ to generate that type of record. Keep in mind – we are using Google Apps. Google has that service to receive, analyze and send the record to us as zip file. Everyday we get one email with the zip file from noreply-dmarc-support@google.com to webmaster@thecustomizewindows.com. Mandrill possibly do not have that DMARC service.

Emails Should Be Signed in Addition

Everyone knows that Emails should be signed by GNU PG key. It is not very difficult to implement for WordPress and OS X GPG tool discussed before, so as Facebook GNU PG. Otherwise a malware on your server can sent valid emails, none will understand who is replying using admin@thecustomizewindows.com. Support can reply or I can reply.

I sent an email from admin@thecustomizewindows.com to my email me@abhishekghosh.pro and in Apple Mail, got this from View > Message > Raw Source. SPF, DKIM and GPG are present. I altered the RSA key to smaller and modified that X-ZohoMail-Sender: x.x.x.x :