Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to others with their email in the
Well, now I learned that this is not a good idea because those emails will most likely be rejected. However, I do not yet fully understand it.
What I read so far does SPF check the
Envelope From header.
Now let's assume a user wants to send an email to others using my web application. So, the user wants to use
firstname.lastname@example.org as his sender address. Now, my web application will put this address to the
FROM header and send the email using my own email server to the recipients. Because I'm using my own email server, the
Envelope From header should be my own domain, i.e.
As said before, SPF checks AFAIK the
Envelope From (MAIL_FROM) header. So the recipient's server will ask my DNS and check if the corresponding IP addresses are allowed to send mails as
email@example.com. That's possible, so the mail should not be rejected.
Summarizing, so far everything should work (if I understand it correctly). But now let's look into DKIM.
And here's what I do not understand. I know that using DKIM on my mail server will sign the email and the recipients will check using the public key that is pointed to in the DNS.
However, what do they look for? Do they look for the
Envelope From header again only? Then it should work again, no? Because the email is signed using my private key and the recipients will also look for my public key in the DNS.
Or is DKIM looking for the FROM header? Then it would not work because I cannot sign the email with a private key found on the DNS for
Unfortunately, I have not yet found exactly WHEN an email is rejected using DKIM. I hope someone can help me! Thanks a lot.