Re:FastMail loses customers, faces calls to move over anti-e...
by Felz on Monday February 25, 2019 @06:27AM
(#19244821)
Don't SPF/SSL also provide proof that email comes from where it says it does? As far as I can tell, DKIM's advantage is to allow for direct message forwarding (not remailing), which is a fair use case, but pretty specific. In return it introduces a fair chunk of complexity to do right, with signing and message key rotation and keeping track of who you gave keys to.
SpamAssassin assigns small positive scores for valid SPF/DKIM/whatnot headers (and larger negative for lacking either), but it's not really an effective spam deterrant. Spammers can set up their own domains that pass all the checks (although I've heard they're having good times just sending from Gmail).
Re:FastMail loses customers, faces calls to move over anti-e...
by sergiosgc on Monday February 25, 2019 @12:28PM
(#19247388)
SPF authenticates the envelope-from domain, while DKIM authenticates the header-from domain. They're both useful, specially coupled with DMARC.
DMARC authorizes recipient servers to outright refuse email from your domain if it does not contain a valid DKIM signature, and/or comes from a non-authorized IP.
In short, SPF+DKIM+DMARC prevent email spoofing from your domain, protecting you from backscatter and reputation degradation.
About DKIM: It adds another layer of authentication to the email by adding a signature. It being absent isn't really a bad indicator, because unfortunately email headers might change during delivery. This will invalidate the DKIM signature. But it being there is a strong positive that the email comes from the domain it says it does. From another perspective: An email that might be filtered as spam without DKIM is more likely to go through with a positive DKIM result.