Warning: DNS/Email nerdery below.

For my sins, one of the things I had to do recently was complete DNS domain authentication, DKIM, and DMARC for some email domains at work in Mailchimp. Mailchimp is the spamming engine mass email system of choice, and to be fair, they’re responsible and force compliance with good practice. They also try to increase the chances of your spam legitimate mass email being deliverable, which is where this comes in.

The big email providers such as Yahoo, Hotmail/Outlook, and Gmail now insist that if you send over a certain threshold, you:

* Send from a domain you own
* Configure DKIM, SPF, and DMARC
* Don’t send shitloads of actual spam
* include a one-click unsubscribe

This is all part of the spam arms race: electronic means to detect spam are less effective, so this is an attempt to stop the problem at source by making sure the email is coming from where it claims to: spoofing email is trivial, so this effectively adds a signature.

Well, we already had the domain, and SPF, we don’t actually spam people, and Mailchimp handles the unsubscribe, so that left DKIM and DMARC. This actually isn’t that hard, just involving publishing a few records in DNS that match up with the email servers. The DMARC is little more than a published policy of what people should do if the mail seems to be unathenticated- and “take no action” is acceptable. The actual authentication is done by DKIM, where you publish a public key in DNS, and the email is signed by your outgoing server with a corresponding private key. If the encryption key matches, the mail is deemed as being legitimate.

So, I went ahead and did all this for our own infrastructure, as it seems silly to set it all up only for the mass mailing. Pretty simple, too, in the end.

Now, obviously, if someone (Mailchimp) is sending mail for you, you need to publish their key for DKIM. The logical way to do this is for them to publish it, and then for you to alias an entry in your DNS (with what is called a CNAME record). That way, if they change the key, it keeps working without changes to your DNS.
Continue reading Flat Out →