internetstandards / Internet.nl

Internet standards compliance test suite
https://internet.nl
172 stars 35 forks source link

Add note on working MX, FCrDNS and SPF+DKIM+DMARC to documentation #1228

Closed baknu closed 5 months ago

baknu commented 8 months ago

Some inbound mail servers may check whether an SMTP EHLO domain has (1) a working MX and (2) FCrDNS. So, for the mail test it is important that the EHLO domain that is used by the Internet.nl test suite has both in place.

For the EHLO domain setting see: https://github.com/internetstandards/Internet.nl/blob/742676088ac86a4c6017491831ac14e981b26de5/internetnl/settings.py#L97 And see: https://github.com/internetstandards/Internet.nl/blob/742676088ac86a4c6017491831ac14e981b26de5/docker/host-dist.env#L24 Is it indeed correct that e.g. batch.internet.nl is using batch.internet.nl as the EHLO domain?

Furthermore, SPF+DKIM+DMARC should be configured. In case a domain is used for the Internet.nl test suite that has no regular outbound mail the following records should be used.

internet.nl     IN TXT  "v=spf1 a -all" ; The "a" mechanism is needed for the mail test (see rfc7208, section-2.3).
_domainkey.internet.nl  IN TXT  "v=DKIM1; p="   ; empty DKIM to score 100% for this non-sending subdomain that does have SPF "a" mechanism which is needed for mail test.
_dmarc.internet.nl  IN TXT  "v=DMARC1; p=reject; sp=reject;"

The right place in the documentation to cover this seems to be: https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md#dns-setup

mxsasha commented 6 months ago

Is it indeed correct that e.g. batch.internet.nl is using batch.internet.nl as the EHLO domain?

RFC821 says "host name of the sender-SMTP", so that would suggest yes.