<story><title>I figured out how DMARC works, and it almost broke me</title><url>https://simonandrews.ca/articles/how-to-set-up-spf-dkim-dmarc</url></story><parent_chain></parent_chain><comment><author>RedShift1</author><text>You can boil it down to this:&lt;p&gt;* SPF:  Tell the world which servers are allowed to send email for your domain&lt;p&gt;* DKIM: Weak version of digitally signed email, add a header that only mailservers that have the private key you supply can generate. Tampering invalidates the signature (for example when an email gets relayed for a second time). The private key used counts for your whole domain.&lt;p&gt;* DMARC: Tells other mailservers what to do when the SPF and&amp;#x2F;or DKIM check fails, and also allows you to set an address where to send reports to. These reports contain counts of messages that failed the SPF and&amp;#x2F;or DKIM checks.</text></comment>
<story><title>I figured out how DMARC works, and it almost broke me</title><url>https://simonandrews.ca/articles/how-to-set-up-spf-dkim-dmarc</url></story><parent_chain></parent_chain><comment><author>pixelmonkey</author><text>Shortcuts for HN readers to avoid the pain of SPF, DKIM, and DMARC.&lt;p&gt;- Cloudflare Email Routing and DMARC Management. If all you need is inbound email inboxes at a custom domain that routes to your GMail or other addresses, this is the way to go.&lt;p&gt;- Fastmail. If you want an alternative to GWorkspace that is cheaper and more lightweight and that has its own non-Google mobile apps and a fast web app. Also if you need IMAP, POP, SMTP support.&lt;p&gt;- GWorkspace. Sometimes you just have to give in to the overlords. If you need inbound&amp;#x2F;outbound business mail that just works and integrates with all the Googley services, including GMail and GDrive, you just have to give in to this. Cloudflare makes the DNS setup easier if you go with this option. (They have a x-admin-panel integration.)&lt;p&gt;- Honorable mention for Opalstack.com. They&amp;#x27;ll give you open source powered email-server-in-a-box. On a shared Linux server, Procmail rule support, and with Roundcube access for mailboxes.&lt;p&gt;- The tool &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;learndmarc.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;learndmarc.com&lt;/a&gt; is particularly helpful for debugging. It generates a unique email address you can send an email to and it&amp;#x27;ll tell you what&amp;#x27;s happening from an SPF, DKIM, and DMARC standpoint. All in the browser.</text></comment>