3

I am the sysadmin for my church. Our church has our own domain website and email hosted externally. We have about 50 members or so who use their church email from home. I am just looking for best practices that I can employ in our DNS to help control things like spam and email spoofing better?

For sending:

1) How can SPF be utilized best when these users are sending emails through another MTA, which is usually the case as they all have their own ISP at home? If I setup SPF for our domain there is only a handful of ISP's where I live so I suppose one approach that I could take is including the ISP MTA in the record. But is there a better way to use SPF so when they send as @churchdomain from home a receiving SPF implementation does not reject?

For receiving:

2) For our users receiving emails at @churchdomain at their home is there anything I can do outside of tweaking our email hosting providers spam settings to filter email? IIRC setting up SPF on the church domain would only help with the sending aspect.

Any insights or help is greatly appreciated.

Improve this question
5
  • SPF isn't that effective I don't believe. You would also want to configure DKIM/DMARC to make a real difference. Filtering is best done by an aggregator service such as MailRoute or Office 365 since they see the bigger picture (multiple tenants).
    – Julian Knight
    Sep 10, 2016 at 13:29
  • How can I configure DKIM when the public key goes in my DNS record and the private key stays with the SMTP server? Which in my case I have no control over?
    – user53029
    Sep 10, 2016 at 13:38
  • And, I'm assuming here that everyone is using the ISP's SMTP, or a different SMTP server. I suppose I could setup DKIM and have everyone use mail.churchdomain.com as the SMTP server, providing the ISP allows this type of forwarding.
    – user53029
    Sep 10, 2016 at 13:50
  • That isn't forwarding. Users MUST use your church mail domain for sending email from the church mail domain, anything else is spoofing which is often treated - rightly so - with both suspicion and fairly extreme prejudice. All mail clients allow this to be configured.
    – Julian Knight
    Sep 10, 2016 at 16:08
  • DKIM/DMARC tells other servers that your email comes from your server. If you cannot set it up because the ISP doesn't support it, there is little you can do. SPF is of very little use since nearly all spammers have valid SPF records.
    – Julian Knight
    Sep 10, 2016 at 16:10

1 Answer 1

Reset to default
2

How can SPF be utilized best when these users are sending emails through another MTA, which is usually the case as they all have their own ISP at home?

The usual setup of an user facing MTA today requires authentication by the user and often restricts the user to only use the email connected to the authorized user account as sender. This means that users don't use a single MTA for multiple sender addresses but use a separate MTA for each sender address. For example a user connected via some ISP X would still use smtp.gmail.com for delivering mail with its gmail account as sender.

This means that you have to do the same as all the other mail providers: setup your MTA, require authentication and allow only authorized users to send mail with the sender address associated with their user account. Once this is done all outgoing mail from your domain will originate from your mail server and you could easily employ restricted SPF records and also DKIM signatures.

For receiving: ...

While you can add SPF, DKIM and other anti spam checks to incoming mail your own SPF settings do not matter at all in this case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .