SPF for domains der IKKE skal sende e-mail

( Se også "DKIM for domains der ikke skal sende e-mail" )

When it comes to email deliverability, most people are trying to figure out how to ensure their mail lands in the inbox. But what if you want to tell email providers that they should not accept email from a domain name? This might be the case if you have a parked domain that someone is trying to spoof when it sends email.

One option is to create a Sender Policy Framework (SPF) record that says all mail should be rejected. To do this, go to your domain name registrar and manage the DNS for the domain.

Create a TXT record and include this text:

contoso.dk TXT "v=spf1 -all"

This will tell mailbox providers that your domain name should not send any email, giving them an indication that email with your address should be considered spam.

Domain name owners should consider adding SPF records to their parked domains if they don’t use them for email.

DKIM for domains der IKKE skal sende e-mail

Identify domains that do not send email

(Se også "SPF for domains der ikke skal sende e-mail" )

Organizations should explicitly state if a domain does not send email by specifying v=DKIM1; p= in the DKIM record for those domains. This advises receiving email servers that there are no valid public keys for the domain, and any email claiming to be from that domain should be rejected. You should do this for each domain and subdomain using a wildcard DKIM.

For example, the DKIM record would look like this: (TXT record !)

*._domainkey.SubDomainThatShouldntSendMail.contoso.com. TXT "v=DKIM1; p="

MX Toolbox Supertool - DKIM

SPF Flattening

100% free SPF flattening with alerting or automatic SPF

https://www.autospf.com/

DKIM på Office365 med Powershell

https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps
https://docs.microsoft.com/en-us/office365/securitycompliance/use-dkim-to-validate-outbound-email#SetUpDKIMO365

http://www.mail-tester.com/spf-dkim-check (Her kan du få navnet på DNS CNAME record - selector1._domainkey.contoso.dk + ***)
https://mxtoolbox.com (tjek dkim opsætning - dkim:contoso.dk:selector1)


Start powershell som administrator, log på og indlæs PS Exchange extensions

Set-ExecutionPolicy RemoteSigned
Log på (O365 tenant credentials)
$UserCredential = Get-Credential

Indlæs PS Exchange extensions
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking

Start dkim konfiguration
New-DkimSigningConfig -DomainName contoso.dk -Enabled $false (sætter dkim til Off - viser fejl hvis det allerede er off) 
Get-DkimSigningConfig -Identity contoso.dk | fl Selector1CNAME, Selector2CNAME           (*** den viser de records der skal oprettes)

Selector1CNAME : selector1-contoso-dk._domainkey.dkcontoso.onmicrosoft.com (navn selector1._domainkey.contoso.dk, FQDN selector1-contoso-dk._domainkey.dkcontoso.onmicrosoft.com)
Selector2CNAME : selector2-contoso-dk._domainkey.dkcontoso.onmicrosoft.com (navn selector2._domainkey.contoso.dk, FQDN selector2-contoso-dk._domainkey.dkcontoso.onmicrosoft.com)

Tilføj DNS records - tjek med http://www.mail-tester.com/spf-dkim-check  (bemærk at det kan tage lang tid før MS's DNS opdateres og brug output fra Get-DkimSigningConfig -Identity contoso.dk | fl Selector1CNAME, Selector2CNAME)

Set-DkimSigningConfig -Identity contoso.dk -Enabled $true
https://mxtoolbox.com (tjek dkim opsætning - dkim:contoso.dk:selector1)


Når færdig
Remove-PSSession $Session

Start DMARC opsætning

Check DKIM Office365

Powershell som administrator

Set-ExecutionPolicy RemoteSigned

winrm get winrm/config/client/auth (skal være Basic = true)

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session -DisableNameChecking


Get-DkimSigningConfig -Identity CONTOSO.DK | Format-List (dit domæne navn)


Remove-PSSession $Session

SPF, DKIM, DMARC

Test the Spammyness of youre-mails
https://www.mail-tester.com

Sørg for at emnefeltet har relevant indhold, f.eks. "Question about service provided) - ikke bare "Test" eller lign.
Selve e-mailen skal også have et relevant indhold, gerne en 25-50 ord (kopier en tekst fra et andet sted)

Check if your domain has these 2 email signatures set up and valid (DKIM)
https://www.mail-tester.com/spf-dkim-check

Selector = Selector1 og Selector2

dmarcian.eu
mxtoolbox.com DKIM:domain.dk:selectorX

https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps

https://docs.microsoft.com/en-us/office365/securitycompliance/use-dkim-to-validate-outbound-email#SetUpDKIMO365

https://blogs.technet.microsoft.com/timmcmic/2018/02/09/office-365-spam-detection-and-reverse-dns-lookups/