You need to add the NULL MX and SPF records alongside every A and AAAA record. DMARC applies to subdomains unless they provide their own policy. Just make sure not to have a permissive policy for subdomains via the sp parameter. SPF hardly does anything. It's DMARC that matters.
Conversation
DMARC requires valid, aligned SPF / DKIM. The policy specifies what to do when it fails to pass. A p=reject policy will prevent spoofed emails from the domain to providers enforcing DMARC. SPF itself doesn't stop spoofing since it does not need to be aligned with the FROM header.
2
1
3
An email admin that I trust maintains that there is a way to do DMARC without DKIM.
It’s some minutia of DKIM that I’m not aware of.
I have not yet dug into and verified his claims.
1
DMARC requires either valid, aligned SPF or valid, aligned DKIM. That's how DMARC works. DKIM provides a way to verify signed email but doesn't enforce it, so it doesn't prevent spoofing alone, since it's not mandatory. SPF hardly does anything without DMARC due to alignment.
2
Yes, I largely agree.
I’ve had SPF, DKIM, and DMARC configured on my domains for years.
The key word is “either” mei ONT that one (SPF) is sufficient for DMARC.
Should you have DKIM too? Yes.
Is DKIM technically required? I don’t think so.
1
I’d have to go back and re-read minutia of multiple RFCs.
But I’d rather exert less effort and use DKIM. Like I have done.
1
No one said DKIM is required. To prevent spoofing email from a domain to properly configured servers, only a DMARC p=reject policy is required. That requires that there is either valid, aligned DKIM or valid, aligned SPF. Lack of a DKIM / SPF setup will result in rejection.
1
If you want to extend the topic to actually sending email that passes DMARC, then sure, you can implement that with either SPF or DKIM instead of both. That's how DMARC works. However, if you only do SPF, you won't be able to send email via mailing lists / relays like with DKIM.
2
DKIM + DMARC is a lot more flexible because mails can be forwarded as usual, and it remains valid as long as there's no tampering with the email. A mailing list can still prepend List-Unsubscribe and other headers that aren't oversigned. DMARC with SPF only works directly.
2
1
If I configure DKIM and DMARC, I should _not_ have SPF records? Various (unauthoritative) sources had me convinced that I needed SPF as well.
I ran mailing lists for many years without problems (and without DMARC, DKIM, and SPF), but last year that became unworkable.
2
DMARC verification will pass with DMARC and DKIM set up properly. A DMARC policy with p=reject is fully compatible with mailing lists as long as they don't tamper with emails. Mailing list software should leave emails alone. They shouldn't tamper with signed headers / content.
Mailing list software has mostly been updated to be compatible with DMARC by respecting DKIM. If the software is misconfigured to tamper with emails while still claiming they came from the original source, which is not true, DMARC will result in them being rejected/quarantined.
1
1
1
Solution: do not spoof emails. Mailing list software can still add List-Unsubscribe and other headers that are not oversigned. It can modify headers that are not signed. If the administrator insists on modifying the subject, content, etc. then the software has to change FROM.
1
1
1
Show replies
Not if there is also an SPF record that rejects the mailing lists MTA and a DMARC policy that wants both SPF and DKIM to pass.
2
1
1
No, because that's not how SPF works. SPF does not require alignment with the FROM header. A hard fail SPF record permitting only your mail server is NOT incompatible with sending mail via a relay or list. SPF will pass based on MAIL FROM, which is why it doesn't stop spoofing.
1
1
1
Show replies