Cloudflare Developers•2y ago

What should I put or what's the setup for DMARC policy?

DDarrel What should I put or what's the setup for DMARC policy?

dave•3/26/24, 10:15 PM

depends on how you send emails out normally

Ddave There's quite a few use-cases that we already have deployed, that use Email Work...

DarkDeviL•3/26/24, 10:24 PM

And the reason for the "So if [...]So if [...]".

However, any of such other possible solution that does not directly forward the message, would still make the email flow a lot more "insecure", by not rejecting DMARC failures, according to sender's selection of what to do with messages that fail authentication.

DarkDeviL•3/26/24, 10:25 PM

If you want to be able to process any messages, regardless of their authentication status, - I'd go as far as to say you would need to roll up your own inbound infrastructure.

Ddave depends on how you send emails out normally

DarrelOP•3/26/24, 10:28 PM

There are three options in cloudflare for DMARC policy. I already have DMARC added but it's set to None but there's an option for Quarantine and Reject.

I don't have DKIM. I don't understand this and I think I was trying to add this a few days ago but I don't know what to put.

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

DarkDeviL•3/26/24, 10:29 PM

The message as you see here, was not DKIM signed at the time that it reached Cloudflare's Email Routing ("DKIM status: none").

As per the Yahoogle! requirements (Google and Yahoo requirements) per 2024-02-01 (February 2024), emails MUST be authenticated.

SPF cannot survive message forwarding, so the only option you have, is to properly DKIM sign your emails (WITH PROPER ALIGNMENT to your own domain), if you expect any deliveries to Yahoo and Google after that date.

Without a such proper DKIM set up from the sender's side, Google will give the message the cold shoulder.

DDarkDeviL The message as you see here, was not DKIM signed at the time that it reached Clo...

DarrelOP•3/26/24, 10:54 PM

You mean setup DKIM on Cloudflare right? Can you show how to do it?

DarrelOP•3/26/24, 10:55 PM

There's: Record information
Provide the corresponding information to generate your DKIM record.
Selector
Uniquely identifies a DKIM public key on this domain. ????

Content
Enter the DKIM record content from your email provider.???

DDarrel You mean setup DKIM on Cloudflare right? Can you show how to do it?

DarkDeviL•3/26/24, 10:57 PM

As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

DDarkDeviL As Cloudflare does not operate an outbound email service: No, not at Cloudflare.

DarrelOP•3/26/24, 11:26 PM

Okay so people are now being forced to get a subs right? This is what's going now

DDarrel Okay so people are now being forced to get a subs right? This is what's going no...

DarkDeviL•3/26/24, 11:27 PM

Not sure I get the point of what you mean here?

DarrelOP•3/26/24, 11:27 PM

I really loved how cloudflare works before because we don't need diff email apps to use until this happened.

DDarkDeviL Not sure I get the point of what you mean here?

DarrelOP•3/26/24, 11:28 PM

Based on what you are saying we have to migrate to diff platforms other than cloudflare right since their email routing isnt working properly now and you said we can't set DKIM

DDarrel Based on what you are saying we have to migrate to diff platforms other than clo...

DarkDeviL•3/26/24, 11:28 PM

No, I don't.

DarkDeviL•3/26/24, 11:29 PM

Google (Gmail) started to mandate some stricter requirements than what they have been doing before.

DarkDeviL•3/26/24, 11:29 PM

The point where you are talking about migrating away from Cloudflare would be wrong.

DarkDeviL•3/26/24, 11:29 PM

What you should do, is to migrate away from Google (Gmail) instead.

DarrelOP•3/26/24, 11:29 PM

Yes, what I only mean is the email not the domain

DarkDeviL•3/26/24, 11:29 PM

Google (Gmail) is the ones setting these new stricter requirements, for the rejection you posted.

DarrelOP•3/26/24, 11:30 PM

What do u mean? We mainly use gmail emails.

DDarkDeviL Google (Gmail) is the ones setting these new stricter requirements, for the reje...

DarrelOP•3/26/24, 11:31 PM

That's what I thought. So this is not happening to outlook emails? But it may still happen soon too right because cloudflare does email routing and its beta

DDarrel That's what I thought. So this is not happening to outlook emails? But it may st...

DarkDeviL•3/26/24, 11:33 PM

It probably depends what you mean with how it's not happening to "outlook mails".

DDarrel SPF status pass DMARC status none DKIM status none Rejected reason: Unknown erro...

DarkDeviL•3/26/24, 11:33 PM

Who exactly (what domain) was listed above all this spaghetti, as the "SenderSender"?

DarkDeviL•3/26/24, 11:34 PM

If it had the SenderSender set to bob.johnson@example.combob.johnson@example.com, all I'm asking for is example.comexample.com.

DarrelOP•3/26/24, 11:34 PM

Like when emails are forwarded to outlook not gmail

DDarrel Like when emails are forwarded to outlook not gmail

DarkDeviL•3/27/24, 4:35 AM

That wouldn't really change a thing, - it would similarly appear to work at periods, but have periods where it doesn't.

DarkDeviL•3/27/24, 4:36 AM

Forwarding to any free mail provider (be it Google/Gmail, Microsoft's Outlook / Hotmail, or wherever) cannot be characterized as a "reliable" email set up.

DarrelOP•3/27/24, 8:44 AM

That's what I am saying awhile ago so we should sign up for an email service now right because setting up dkim or dmarc policy on cloudflare doesnt matter at all?

DDarrel That's what I am saying awhile ago so we should sign up for an email service now...

DarkDeviL•3/27/24, 11:07 AM

You cannot set up DKIM on a forwarding service, that is a thing that MUST be done properly on sender's side.

DDarkDeviL Who exactly (what domain) was listed above all this spaghetti, as the "**`Sender...

DarkDeviL•3/27/24, 11:07 AM

DDarkDeviL If it had the `Sender` set to `bob.johnson@example.com`, all I'm asking for is `...

DarkDeviL•3/27/24, 11:07 AM

DarkDeviL•3/27/24, 11:09 AM

bob.johnson@example.combob.johnson@example.com -> your@email-routing.exampleyour@email-routing.example (your Cloudflare Email routing domain) -> example@gmail.comexample@gmail.com

It is the owner / operator of example.comexample.com, that needs to set up DKIM properly from their end.

DarkDeviL•3/27/24, 11:10 AM

Or alternatively:

newsletters@cloudflare.comnewsletters@cloudflare.com -> your@email-routing.exampleyour@email-routing.example (your Cloudflare Email routing domain) -> example@gmail.comexample@gmail.com

It is the owner / operator of cloudflare.comcloudflare.com, that needs to set up DKIM properly from their end.

DarkDeviL•3/27/24, 11:12 AM

DKIM can (assuming the DKIM signing has been done properly from sender's (email provider's) end) survive email forwarding, and provide proper email authentication for the message, once the message is received on Gmail.

DarkDeviL•3/27/24, 11:13 AM

SPF isn't be able to survive forwarding, - it will always either fail, OR have lost it's alignment to the original domain.

DarrelOP•3/27/24, 11:18 AM

Okay, therefore we need to reconfigure our work emails and find other providers then. You mean we cannot use cloudflare email forwarding properly for now since Gmail has updated their thing.

DDarrel Okay, therefore we need to reconfigure our work emails and find other providers ...

DarkDeviL•3/27/24, 11:20 AM

That "we" depends a lot.

DarkDeviL•3/27/24, 11:20 AM

WHO was the sender of the message you had rejected by Gmail?

DarkDeviL•3/27/24, 11:21 AM

If the sender was yourself, - then YES, then YOU need to do something.

DarkDeviL•3/27/24, 11:22 AM

If the sender was me, - then NO, then YOU WON'T need to do something, I NEED to do something on MY END.

DarrelOP•3/27/24, 11:24 AM

Our domains are on cloudflare. The work emails are routed to gmail and we configure them on gmail smtp.

DarkDeviL•3/27/24, 11:26 AM

Were YOU the actual Sender the rejected message,?

DarrelOP•3/27/24, 11:29 AM

Normally its being rejected if I send as the work email on gmail to another work email. If I send it from the actual gmail to a work email it will go through

DarrelOP•3/27/24, 11:30 AM

In Gmail
Send from: work email
Send to: work emai
Normally fails

Send from: actual gmail
Send to: work email
will go through and receive fine normally

DDarrel In Gmail Send from: work email Send to: work emai Normally fails Send from: act...

DarkDeviL•3/27/24, 11:45 AM

The first one:

In Gmail
Send from: work email
Send to: work emai
Normally fails

With "In Gmail", we're talking a free @gmail.com@gmail.com address, where you have set up the work emailwork email as being support@example.comsupport@example.com, exactly as shown in the following image?

DarkDeviL•3/27/24, 11:45 AM

DarkDeviL•3/27/24, 11:45 AM

Is that correct?

DDarkDeviL Click to see attachment

DarrelOP•3/27/24, 11:56 AM

This is the second screen. The first shows two boxes and I put the name and the work email then that one I keep smtp.gmail.com on the SMTP server, username is the actual gmail then password is the app password I generated from gmail

DDarrel This is the second screen. The first shows two boxes and I put the name and the ...

DarkDeviL•3/27/24, 12:01 PM

But that is the way you set up the email sending, that is failing, right?

DarrelOP•3/27/24, 12:11 PM

Yes. It was working fine before

DarrelOP•3/27/24, 12:12 PM

I think Gmail did all of this. Like what others mentioned that they updated their sh**

What should I put or what's the setup for DMARC policy?

Similar Threads

Similar Threads

Similar Threads