HowTo: SPF, DKIM and DMARC — email that lands in the Inbox

SPF, DKIM and DMARC stop spoofing and get mail out of Spam. You set them in DNS + Postfix/OpenDKIM. Step by step, with verification.

1. SPF

# SPF: spune ce servere pot trimite mail pt domeniul tau (DNS TXT)
example.com.  IN TXT  "v=spf1 mx a ip4:203.0.113.10 -all"
# -all = respinge restul; ~all = softfail (test)

2. DKIM (keys)

# DKIM: semnatura criptografica (opendkim)
sudo apt -y install opendkim opendkim-tools
sudo opendkim-genkey -b 2048 -d example.com -s mail -D /etc/opendkim/keys/
# cheia publica de pus in DNS:
sudo cat /etc/opendkim/keys/mail.txt

3. DKIM (DNS + Postfix)

# DNS TXT pt selectorul 'mail' (din mail.txt):
mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
# leaga opendkim de Postfix (smtpd_milters) + reporneste:
sudo systemctl restart opendkim postfix

4. DMARC

# DMARC: politica + rapoarte (DNS TXT)
_dmarc.example.com. IN TXT \
  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=s"
# p=none (monitor) -> p=quarantine -> p=reject (dupa ce confirmi ca totul semneaza)

5. Verify

dig +short TXT example.com
dig +short TXT mail._domainkey.example.com
dig +short TXT _dmarc.example.com
# trimite un mail catre check-auth@verifier.port25.com sau mail-tester.com

Conclusion

You now have properly authenticated email (SPF+DKIM+DMARC) that lands in the Inbox and cannot be spoofed. We configure it and monitor the DMARC reports for you.