Being trusted by the servers you send to
-
Getting mail accepted is mostly DNS. hMailServer does the cryptography and the protocol work. It cannot publish records for you. This is the split.
What the server does on its own
DKIM signing. Open the domain's DKIM tab in the Control Panel and click Generate key. It creates an RSA-2048 key, saves the private key, fills in the path and shows the exact TXT record with a Copy button. Once the record is published it signs every outgoing message from that domain. Ed25519 DKIM (RFC 8463) is supported alongside RSA, for shorter keys.
DkimOversignHeadersover-signs the header fields you name.DkimAcceptSha1=0refuses rsa-sha1 signatures on inbound mail.SPF and DMARC inbound. SPF is checked as part of anti-spam scoring, with
SpfVoidLookupLimit=2. DMARC policy is evaluated on inbound mail and the DMARCbis tree walk is on by default (DmarcTreeWalkEnabled=1). Aggregate reporting stays off until you setDmarcRptFromAddress.Outbound transport security.
MtaStsEnabled=1,DaneEnforcementEnabled=1andDnssecValidationEnabled=1are all on by default, under Settings → Security → Transport security. A recipient whose DNSSEC chain is bogus does not receive your mail rather than receiving it unencrypted. That is the point of enforcement, so read the logs before you reach for the switch.TLS-RPT. Off until you set
TlsRptFromAddress. After that the server sends daily reports to recipient domains about TLS failures it hit delivering to them.SRS and BATV.
SRSEnabled=1with aSRSSecretkeeps forwarded mail SPF-aligned. The secret must be stable. Outstanding SRS addresses remain valid for 21 days, so changing it loses bounces for mail you forwarded recently. BATV (prvs) signs your envelope sender so you can recognise and drop backscatter. Neither ever became an RFC. Both follow the widely deployed drafts, as does everything that interoperates with them.What you must publish yourself
PTR, and your ISP sets that one, not you. Missing PTR is the single biggest cause of spam-foldering. Then SPF, the DKIM TXT record, and DMARC. For MTA-STS on the inbound side, point
mta-sts.<domain>at the server, setMtaStsHostingEnabled=1andWebServicesHttpsPort=443, and publish the_mta-sts.<domain>TXT record. If you publish TLSA records for inbound DANE, keepAcmeReuseKey=1so renewals do not invalidate them.Start DMARC at
p=none. Read the reports for a few weeks and confirm all your legitimate mail passes SPF and DKIM before moving top=quarantine, thenp=reject. Starting atp=rejectsilently loses mail from the sender you had forgotten about.Still incomplete
ARC sealing (RFC 8617) covers mail from hosted DKIM-enabled domains. Relayed third-party mail is not sealed yet.
Chapter 8, the DNS records with example syntax: https://www.progressiverobot.com/hmailserver-documentation/#8-making-the-internet-trust-you-dns
Chapter 9.4, outbound transport security: https://www.progressiverobot.com/hmailserver-documentation/#94-outbound-transport-security
Chapter 17.6, SRS and BATV: https://www.progressiverobot.com/hmailserver-documentation/#176-srs-and-batv
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login