{"id":34,"date":"2012-11-27T14:53:23","date_gmt":"2012-11-27T22:53:23","guid":{"rendered":"http:\/\/nuclearprojects.com\/blog\/?p=34"},"modified":"2012-12-07T20:28:58","modified_gmt":"2012-12-08T04:28:58","slug":"how-to-add-google-apps-dkim-domainkeys-and-spf-records-to-dns","status":"publish","type":"post","link":"https:\/\/nuclearprojects.com\/blog\/how-to-add-google-apps-dkim-domainkeys-and-spf-records-to-dns\/","title":{"rendered":"How to add Google Apps DKIM (DomainKeys) and SPF records to DNS"},"content":{"rendered":"<p><em>(Note: As of 12\/7\/2012, Google Apps is no longer offering free accounts&#8230; dang it!!)<\/em><\/p>\n<p>While I lease server space and host my own sites, I&#8217;ve had a lot of issues over the years with the mail server. Sometimes I don&#8217;t get emails that I should or some emails get massively delayed. So the solution I went with was to use an external mail server. Google has a free service that allows you to use their mail servers, called <a href=\"http:\/\/www.google.com\/intl\/en\/enterprise\/apps\/business\/\" target=\"_blank\">Google Apps<\/a>.<br \/>\n<!--more--><br \/>\nGoogle Apps offers more than just free email services, but that&#8217;s all I&#8217;ll focus on here. If you go to the Google Apps site, they&#8217;ll try to get you to sign-up for a demo of their premium services (not free). However, there is a free option if you click on <a href=\"http:\/\/www.google.com\/intl\/en\/enterprise\/apps\/business\/pricing.html\" target=\"_blank\">Pricing<\/a>. There, you&#8217;ll see a FREE option that allows you to have up to 10 users (plenty for a small website). Go ahead, sign up.<\/p>\n<p>Once you get all signed-up and squared away, you&#8217;ll need to update your MX records to show Google&#8217;s servers. This page will show you the correct values: <a href=\"http:\/\/support.google.com\/a\/bin\/answer.py?hl=en&#038;answer=174125\" target=\"_blank\">Google&#8217;s MX record values<\/a><\/p>\n<p>The MX changes will take some time to propagate and take effect, but once they do, you&#8217;re all set to send\/receive mail! BUT&#8230; there are a couple more steps you should take to ensure that the mail you&#8217;re sending\/receiving is properly authenticated. That&#8217;s where <em>Sender Policy Framework(SPF)<\/em> and <em>DomainKeys Identified Mail(DKIM)<\/em> comes into play.<\/p>\n<ul>\n<li><strong>Sender Policy Framework (SPF)<\/strong> is an email validation system designed to prevent email spam by detecting email spoofing, a common vulnerability, by verifying sender IP addresses.<\/li>\n<li><strong>DomainKeys Identified Mail (DKIM)<\/strong> is a method for associating a domain name to an email message, thereby allowing a person, role, or organization to claim some responsibility for the message.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>SPF<\/h2>\n<p>To setup SPF, you&#8217;ll need to add a TXT entry to your DNS record. If you use CPanel, you can do it from the &#8220;Advanced DNS Zone Editor&#8221;. The entries should be similar to this:<\/p>\n<ul>\n<strong>Name:<\/strong> yourdomain.com<strong>.<\/strong><br \/>\n<strong>TTL:<\/strong> 300<br \/>\n<strong>Type:<\/strong> TXT<br \/>\n<strong>TXT Data:<\/strong> v=spf1 include:_spf.google.com ~all<\/ul>\n<p>And yes, that period(<strong>.<\/strong>) should be there at the end of your domain name. For additional information, see Google&#8217;s page about <a href=\"http:\/\/support.google.com\/a\/bin\/answer.py?hl=en&#038;answer=178723\" target=\"_blank\">creating SPF records<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<h2>DKIM<\/h2>\n<p>Setting up DKIM is fairly easy to do as well. First, login to your Google Apps account and head to the &#8220;Domain Management&#8221; section. Next, click on &#8220;Advanced tools&#8221;. Scroll down to the very bottom, click &#8220;Set up email authentication (DKIM)&#8221;.<\/p>\n<p>Next, click &#8220;generate new record&#8221;. Leave the default &#8220;google&#8221; selector there, click &#8220;Generate&#8221;. You&#8217;ll need both of the values that were generated (text record name and value). Keep that page open, and go add another TXT entry to your DNS record as follows:<\/p>\n<ul>\n<strong>Name:<\/strong> google._domainkey<br \/>\n<strong>TTL:<\/strong> 300<br \/>\n<strong>Type:<\/strong> TXT<br \/>\n<strong>TXT Data:<\/strong>v=DKIM1; k=rsa; p=MIGfMA0GCS&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;..AB<\/ul>\n<p>That&#8217;s it! It may take a day or so for all your changes to fully propagate through the &#8216;net, but that&#8217;s all you have to do. Next&#8230; you&#8217;ll want to run some tests.<\/p>\n<p>&nbsp;<\/p>\n<h2>Testing Tools<\/h2>\n<p>Now that you have SPF and DKIM setup, you&#8217;ll want to run some quick tests to ensure everything is working. There are four sites that I&#8217;ve found very useful for this.<\/p>\n<p>1) <a href=\"http:\/\/www.mail-tester.com\" target=\"_blank\">www.Mail-Tester.com<\/a> &#8211; This site is just awesome! Upon visiting, you&#8217;ll be presented with a randomly-generated email address. Copy this address and send a blank email to it. Next, click &#8220;Then Check Your Score&#8221;. It will retrieve your email and run a quick analysis on it. You&#8217;ll see the results clearly displayed, with explanations. Don&#8217;t worry if you don&#8217;t get a 10\/10 right away. I&#8217;ve found it takes about a full day before your DNS fully propagates. Once that happens, you can expect a 10\/10 (unless you have other issues, or typed something wrong in your DNS).<\/p>\n<p>2) <a href=\"http:\/\/www.protodave.com\/tools\/dkim-key-checker\/\" target=\"_blank\">DKIM Key Checker<\/a> &#8211; A simple tool for checking to see if your DKIM key is configured correctly and working. Simply enter &#8220;google&#8221; as your selector (unless you used something else) along with your domain and click &#8220;Check Key&#8221;.<\/p>\n<p>3) <a href=\"http:\/\/www.kitterman.com\/spf\/validate.html\" target=\"_blank\">SPF Query Tool<\/a> &#8211; Another simple tool to check your SPF record. Just type in your domain name and click &#8220;Get SPF Record&#8221;. If all is well, you&#8217;ll get a message that says, &#8220;<em>SPF record passed validation test with pySPF (Python SPF library)!<\/em>&#8220;.<\/p>\n<p>4) <a href=\"http:\/\/www.dnssy.com\/index.php\" target=\"_blank\">DNSsy &#8211; DNS Test and Check<\/a> &#8211; This is an additional tool that I found very helpful, not just for SPF and DKIM. It will analyze everything about your domain&#8217;s DNS records and display the results in an easy-to-read table format.<\/p>\n<p><strong>Lastly&#8230;<\/strong><\/p>\n<p>If you use a mail client to send\/receive mail (such as Thunderbird, Outlook, etc.), <em>make sure to update your account settings!<\/em> Since you are now sending\/receiving mail through Google&#8217;s servers, you need to make sure your mail client&#8217;s settings reflects that. Here are the settings I use:<\/p>\n<p>INCOMING MAIL SETTINGS:<br \/>\n<strong>Mail Server:<\/strong> pop.gmail.com<br \/>\n<strong>Username:<\/strong> you@yourdomain.com (your actual email address)<br \/>\n<strong>Port:<\/strong> 995<br \/>\n<strong>Connection Security:<\/strong> SSL\/TLS<br \/>\n<strong>Authentication Method:<\/strong> Normal password<\/p>\n<p>OUTGOING MAIL SETTINGS:<br \/>\n<strong>Server Name:<\/strong> smtp.googlemail.com<br \/>\n<strong>Port:<\/strong> 465<br \/>\n<strong>Username:<\/strong> you@yourdomain.com (your actual email address)<br \/>\n<strong>Authentication Method:<\/strong> Normal password<br \/>\n<strong>Connection Security:<\/strong> SSL\/TLS<\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Note: As of 12\/7\/2012, Google Apps is no longer offering free accounts&#8230; dang it!!) While I lease server space and host my own sites, I&#8217;ve had a lot of issues over the years with the mail server. Sometimes I don&#8217;t get emails that I should or some emails get massively delayed. So the solution I [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":68,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[11,14,12,16,10,15,13],"class_list":["post-34","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web-programming","tag-dkim","tag-dns","tag-domainkeys","tag-email","tag-google-apps","tag-mail","tag-spf"],"_links":{"self":[{"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/posts\/34","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/comments?post=34"}],"version-history":[{"count":22,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/posts\/34\/revisions"}],"predecessor-version":[{"id":135,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/posts\/34\/revisions\/135"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/media\/68"}],"wp:attachment":[{"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/media?parent=34"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/categories?post=34"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuclearprojects.com\/blog\/wp-json\/wp\/v2\/tags?post=34"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}