EPIC: Prevent spoofing, phishing, and spam

[inhyenoq]

Hypothesis As Google Workplace admins, we believe that preventing spoofing, phishing, and spam will help us solve email delivery issues. Today, new members find noQ account invitation emails in their spam box sometimes. Complying Gmail security precautions will help our emails to arrive in inbox.

Acceptance Criteria

• Check if we have done all Gmail security precautions and complete any found.
• [ ] #655
• [x] Set up SPF
• [ ] #656
• [ ] #657
• [ ] Help prevent Drive spam and phishing

DOR When we check domain MX up, we can see

• [ ] DKIM has been set up
• [x] SPF has been set up
• [ ] DMARC has been set up
• [ ] BIMI has been set up
• [ ] no significant errors or warnings are found on the MX diagnosis results.

[inhyenoq]

### Domain MX diagnosis results https://toolbox.googleapps.com/apps/checkmx/check?domain=noq.nu&dkim_selector=

error

• Domain must have at least one mail server. - No action required

  warning

• DKIM is not set up.
• DMARC is not set up.
• MTA-STS DNS Record. - No action required (Optional setting)
• No Google mail exchangers found. - No action required (Gmail has activated)

  info_outline

• Effective SPF Address Ranges: noq.nu., _spf.google.com, _netblocks.google.com, _netblocks2.google.com, _netblocks3.google.com

  done

• Domain should have at least 2 NS servers.
• Naked domain must be an A record (not CNAME). done
• Every name server must reply with exactly the same TXT DKIM records.
• Every name server must reply with exactly the same TXT DMARC records.
• Every name server must reply with exactly the same TXT MTA-STS record.
• Every name server must reply with exactly the same CNAME records.
• Every name server must reply with exactly the same NS records.
• Every name server must reply with exactly the same MX records.
• Every name server must reply with exactly the same TXT records.
• SPF must allow Google servers to send mail on behalf of your domain.