Email domain authentication: SPF, DKIM and DMARC

Why use e-mail domain authentication?

By default, emails sent via Asset are sent via the Spacewell mail server. However, it is often desirable to make these emails appear to be sent from the client's email address*.

The email itself will still be sent via the Spacewell email server, but the email will look like it originated from the specified client email address. This leads to the emails being rejected by the receiving mailserver. If this happens too often, the IP address the mail is sent from (the Spacewell mail server) can be blocked. This results in no mails being accepted from this IP address.

To prevent this, a few systems need to be set up: SPF, DKIM and DMARC.

*Most likely, a contractor who receives a work order email should receive this email from, for example, ‘facilities@clientname.com’ instead of 'noreply@spacewell.com'. See the email settings section in the client settings article for information on how to set this up.

SPF (Sender Policy Framework)

By adding the necessary SPF record to the DNS, the receiving mailserver can verify that Asset is allowed to send emails on behalf of the client's domain. The following inclusion needs to be done on the DNS:

Testing the SPF record

If you want to test if the SPF record is added correctly, you can use free online tool to see if the spf record is available. Easy to use tools are:

• https://www.dmarcanalyzer.com/nl/spf-2/checker/
• https://mxtoolbox.com/SuperTool.aspx

DKIM (Domain Keys Identified Mail)

With DKIM, a key needs to be generated within Asset, which also needs to be added to the DNS.

Generating the key and DNS record in Asset

1. Within Asset, navigate to the client settings via the tile on the dashboard.
2. Navigate to the tab “Email” and press on the icon for “Signing domains”
   

3. Click on “new”

4. Fill in the following fields:

   • Domain name: the domain name (e.g. mycompany.com)

   • Active: if the DKIM record is active, set to YES
   • DKIM selector: We suggest to set this to spacewell so you can easily recognize the DNS text record.

     • It is possible to configure multiple domains using the same specific selector for the DKIM record.

   5. Click on the top right icon with the key to generate a private and public key
   6. If the private key was externally generated and is encrypted, fill in the password for this private key.
      

   • Open the DKIM entry you have just set up.

   • On the top right, click the icon 'Show the DNS record'.

   Example of the DNS record

   If the domain you are mailing from is mycompany.com and the selector is spacewell . The DKIM DNS record name will be: spacewell._domainkey.mycompany.com

Share the DNS record with your IT department/party

A DMARC record needs to be added to the DNS in the form of a TXT record. This record needs at least p=none and should align with either SPF or DKIM, preferably both.

Example:

1. Navigate to https://mxtoolbox.com/SuperTool.aspx?action=dkim%3amycompany.com%3aspacewell&run=toolpage
2. In the lookup field enter the domain and DKIM selector separated by a colon (:)

   1. For example mycompany.com:spacewell

3. Click ‘DKIM lookup’

If the above options are not sufficient or the client would like to use their own mailserver, that is also possible. Navigate to “Client settings > Email”. Fill in the following fields (be aware: these values should be provided by the client's IT department):

When using the client's own mailbox, there is one major limitation compared to using the native mail feature in Asset. When Asset sends an email to the client server and it fails, it will not retry this email. The simple reason is that if the system did this, it might be blocked due to a possible identification as a DDoS attack (“spamming” the server with requests). If the native email feature is used, an email is retried for 24 hours before failing.

If you want to test if the above settings apply to your e-mail, you can already test those using the methods mentioned in the articles. But one specific way which has proven to work good is the use of mail-test.com. Here you get an e-mail address where you can send an e-mail to, and it checks the spam rating of the e-mail. So enter this e-mail in any location in Asset and make sure an e-mail is sent to that contact. Once it has, press on “check your score” and you have a list of possible problems and solutions on what you can change. Be aware: this is an external tool, so make sure to not send sensitive information in the test e-mail. Also, the tool is used mostly for newsletters, which means that it checks some aspects of the e-mail which are not relevant for application e-mails from a system like Asset.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Validate DKIM and DMARC setup

Allow the use of the client's own mailserver

Mail host: Fill in the host for the e-mail Mail port: Fill in the required port User name: The username with which the mailserver should be accessed Mail password: The password with which the mailserver should be accessed Use SSL Connection: If you would like to use the SSL variant of the connection to the mailbox TLS Mode: Select the TLS mode that you would like to use (leave it on “Default” if unknown)

Limitation

Testing settings