SPF hardening - can I remove mx/ip6/ip4 and go DKIM-only?
I am wondering how feasible it is to send email with a DKIM-only setup, with an SPF record of v=spf1 -all.
If my DMARC policy requires DKIM alignment then recipients who understand DMARC will still accept my mails. Recipients who don't do DMARC but do process SPF would reject them. Is anything known about how common such recipients are in the real world?
I suppose I'd get a lot of 'SPF alignment fail' reports that I'd have to ignore. On the other hand, I'd be protected against the risk of sending email that isn't DKIM-signed for some reason.
It's a shame you can't express "don't bother with SPF, only consider the DKIM result" in a DMARC policy.
Top Answer/Comment:
No, it's infeasible. You won't improve anything this way, rather the opposite.
What you need to firmly understand that you can never control the logic your destination servers apply when they receive your mail. You may set up DKIM, SPF and whatever else, and they might choose to simply ignore it altogether. Instead, or in addition, they may apply their own logic, which you don't encourage, like blacklists and whitelists.
By introducing deliberate SPF failures, you will probably get some reports, but some other receiving servers will probably just drop your mail silently, plus some could probably notice that your IP is constantly failing SFP and therefore it might even automatically get into some blacklist.
Also, it is possible to specify the idea "don't bother with SFP". And that is as simple as just omit it. That will still trigger some receiving servers, as lack of SFP is not generally considered a good practice, but at least it won't be as drastic as permanently failing SFP.
So, the best recommendation to achieve deliverability is still to configure SFP fully and properly, and setup a DMARC policy that both are required to pass.
상단 광고의 [X] 버튼을 누르면 내용이 보입니다