DKIM and canonicalization

Hi.
Recently I noticed my emails were refused by Google.
Damn Google and his rectrictions!!
The message I recieved is: Your email has been blocked because DKIM authentication didn't pass 550-5.7.30 for this message. Gmail requires all email bulk senders to 550-5.7.30 authenticate their email with DKIM. 550-5.7.30 550-5.7.30 Authentication results: 550-5.7.30 DKIM = did not pass 550-5.7.30 To set up DKIM for your sending domains, visit 550-5.7.30...
I've checked SFF, DKIM, DMARC... all is ok, but using certain tool (Red Sift) said: The Canonicalization for the body is set to "simple". This can lead to problems when verifying the email signature. We recommend setting it to "relaxed" for header and body.
Then, how I set up this parameter?? I believe this must be set up on the DKIM record but I can't modify it at ispconfig (but yes where I've configured the domain DNS records. Note: I don't use ispconfig like DNS server).
Thanks.

 

It doesn't matter what dns server you use, as long as the records are correct.

I always test SPF, DKIM and DMARC using mail-tester.com
If all dns records are ok then I will score 10/10 or very close to that (high 9) and I never had any problems with Google afterwards.

 

I've used mail-tester.com and I obtain 9.5 score.
I've used Mxtoolbox and other tools to check SPF and DKIM and all is ok.
This is frustating. I'm turning crazy.
While Microsoft or Yahoo have contact support, Google doesn't.

 

Sorry about my ignorance.
What do you mean about SPF for the hostname? Where I've to add and what syntax is??
My only SPF record is configured where I've my DNS records, this is my hosting provider.
The syntax is:

Code:

v=spf1 mx a ip4:xxx.xxx.xxx.xxx/32 ~all

Thanks.

 

If ip4: contains the public ip your server is using to send mail from you should be ok.
Though /32 is obsolete. It's only usefull for larger subnets, not single ip's.

Your mx record resolves to the same hostname as your server is using to talk to other mailservers?
Then mx and ip4: is double (but shouldn't matter in any way).

 

Yes, ip4: contains my server public ip and the mx record resolves the hostname of my server (I've configured MX10 pinting to mail.mydomain.com and mail.mydomain.com with A register pointig to the public ip)

 

Then I'll have two SPF records like these:
mydomain v=spf1 mx a ip4:xxx.xxx.xxx.xxx/32 ~all
myhostname v=spf1 mx a ip4:xxx.xxx.xxx.xxx/32 ~all
This is ok?

 

Care to explain?
Things like domains, dns, spf etc is my almost daily work.
I don't see the purpose of the 2nd spf record. It's only usefull when the sender is misterx@hostname

 

Google being Google
Did some checking and all my mailserver's hostnames have spf records too. Forgot all about it

It should read

Code:

myhostname v=spf1 a -all

 

I am afraid I don't know how to add an spf record to host.server.com. If I try to add it to the DNS zone for host.server.com using the ispconfig interface, the record ends up in the server.com zone. If I add it as a text record to the host.server.com zone, the record is not recognized as existing by outside tools or by the ispconfig tool when I attempt to add a dmarc record.

 

so on godaddy i put as a second spf record
Type Name Value
TXT MX1 v=spf1 a -all

Correct?

 

Seems good.

 

sending outbound to gmail (google)
turns out to be a negative with a second spf at godaddy: (spf info from header)
spf=none (google.com: [email protected] does not designate permitted sender hosts) [email protected]
then with a combined spf at godaddy: (TXT @ v=spf1 a mx ip4:xxx.xxx.xxx.xxx include:mx1.mycompanya.net ~all)
Received-SPF: pass (google.com: domain of [email protected] designates xxx.xxx.xxx.xxx as permitted sender) client-ip=xxx.xxx.xxx.xxx;

 

"TXT MX1 v=spf1 a -all" is not for @mycompanya.net addresses.
For that is record "TXT @ v=spf1 xxx -all" (or "TXT mycompanya.net. v=spf1 xxx -all" which is the same).
Where "xxx" can be a, mx, ip4:xxx, ip6:xxx, include:xxx (and more parameters).
All depending on which server(s) you want to permit to send mail from @mycompanya.net.

Btw, don't you have tripled the same server in your spf now?
If mx, ip4:xxx and include:xxx are all the same server then just one of them is enough.
You should keep the number of record types and includes as low as posible since there is a limit of 10 dns lookups in a spf record.
(ip4 and ip6 are not dns lookups so they don't count)

 

it was a strange thing, and yes it looks tripled, the mx & ip and hostname are all the same but google likes it and i only need 1 spf record