HowTo: SPF, DKIM si DMARC — email care ajunge in Inbox

SPF, DKIM si DMARC opresc spoofing-ul si scot mailul din Spam. Le configurezi in DNS + Postfix/OpenDKIM. Pas cu pas, cu verificare.

1. SPF

# SPF: spune ce servere pot trimite mail pt domeniul tau (DNS TXT)
example.com.  IN TXT  "v=spf1 mx a ip4:203.0.113.10 -all"
# -all = respinge restul; ~all = softfail (test)

2. DKIM (chei)

# DKIM: semnatura criptografica (opendkim)
sudo apt -y install opendkim opendkim-tools
sudo opendkim-genkey -b 2048 -d example.com -s mail -D /etc/opendkim/keys/
# cheia publica de pus in DNS:
sudo cat /etc/opendkim/keys/mail.txt

3. DKIM (DNS + Postfix)

# DNS TXT pt selectorul 'mail' (din mail.txt):
mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
# leaga opendkim de Postfix (smtpd_milters) + reporneste:
sudo systemctl restart opendkim postfix

4. DMARC

# DMARC: politica + rapoarte (DNS TXT)
_dmarc.example.com. IN TXT \
  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=s"
# p=none (monitor) -> p=quarantine -> p=reject (dupa ce confirmi ca totul semneaza)

5. Verificare

dig +short TXT example.com
dig +short TXT mail._domainkey.example.com
dig +short TXT _dmarc.example.com
# trimite un mail catre check-auth@verifier.port25.com sau mail-tester.com

Concluzie

Ai email autentificat corect (SPF+DKIM+DMARC), care ajunge in Inbox si nu poate fi falsificat. Il configuram si monitorizam rapoartele DMARC pentru tine.