Jump To: Support > KB > NetManager > Email > SPFDKIM
SPF and DKIM
Sender Policy Framework (SPF)
SPF allows you to state which mail servers are allowed to send mail from your domain. The idea is that if someone else sends a mail that pretends to be from you from their own system, it will be recognised as invalid.
Other mails servers may choose to look at this as part of their spam filtering, so if your sent mails are being incorrectly categorised, you should look at setting this up. This is set in the DNS records for your domain and so (usually) is not under the control of NetManager. However, you can view your SPF records (if any) using E-Mail Administration > Validation > SPF.
DomainKeys Identified Mail (DKIM)
DomainKeys Identified Mail is an email authentication method designed to detect email spoofing. It allows the receiver to check that an email that claims to have come from a specific domain was indeed authorised by the owner of that domain. It goes further than SPF as the mail itself is altered to contain a signature which can be used by the recipient to check whether the important parts of the email have been tampered, such as the From address, To address, Subject and Date.
To enable DKIM on your outbound mails, visit E-Mail Administration > Send/Receive > SMTP sending in webadmin and tick the Enable DKIM signing box. Alternatively, enable it by setting mail_dkim_enable="y" in your configuration file and then running the sendmail build script.
Once you are actively signing your outbound emails with DKIM, you need to create a TXT record in the DNS records for your domain. If you go to E-Mail Administration > Validation > DKIM, the correct record will be displayed ready for you to copy and paste.
By default, the DKIM selector is set to mail. To override this, set a value for mail_dkim_selector in your configuration file.
Each local mail domain that NetManager knows about (i.e. those configured in the Main e-mail domain and Additional domains settings in E-Mail Administration > Send/Receive > SMTP receiving in webadmin. The corresponding settings file entries are domain_external and mail_domains) will have separate keys for DKIM. This means that if your mail domains are domaina.com and domainb.com, you will need DNS records for mail._domainkey.domaina.com and mail._domainkey.domainb.com (which would be separate DNS zones, of course).
If you prefer to use the same domain for all your DKIM records, set mail_dkim_domain to the domain you wish. This works by basing the selector on the domain in the email (in this case, the value of mail_dkim_selector is ignored). For example, if your mail domains are domaina.com and domainb.com and you have set mail_dkim_domain="master.com", the DNS records will be domaina-com._domainkey.master.com and domainb-com._domainkey.master.com.
If you put a domain in domain_external or mail_domains, the local email server will accept mail for that domain and will also check the sending addresses are valid if you try to send mail for that domain through it. If your mail server is to be used as an outbound relay only, but you do not want it to use it for inbound mail, put all the domains you wish to sign with DKIM as a space-separate list in mail_dkim_signdomains instead of adding them to domain_external or mail_domains.