Stop going to Spam: DMARC, SPF and DKIM Explained

resend.com.

SendGrid Mandrill. There's lots of them out there.

So what is allows you to specify SPF. Ideally, both. But in that case, I could only do SPF.

utility. Right? They also have some services on top of it? So Crazy.

lately that I recently

so that's what's referred to as transactional email. And then then you also have email marketing. Hold on. Yeah. Sorry. Before you move on from that, let me even put another one in front of you JS resend

effortlessly. So shout out to resend.

It was really easy to get started.

Yeah. There are some some services on top of it. There's, like, React stuff. I think there's even some, like, template stuff inside of Oh, yeah. They'll compile your emails as well. Yeah.

And those Vercel, like you're likely not running your own mail servers.

like Amazon, hostnames in that that text record.

Like, is it it's. I don't think it's not it's not just another, 1 of 2 things. 1,

You're likely using a service that will send them on your behalf because they have all the infrastructure or the email receivers set up in Google Workspace. And I you cannot get And via any method, what to do when they receive email that is sent on your behalf.

to something that's a single email that is sent to a single user that is called transactional email. And and or

JS one that I've been using

Email for developers, it it it felt very nice as an onboarding process for this thing, and it it worked

But for the most part, I found it to be pretty cheap. For $0 a month, you get 3,000 emails a month.

DKIM alignment set up with aliases in Google Workspace, only SPF, which at first I was like, oh, crap. But I had talked to a couple of people online and they said the tricky part is, is that, yes, you want other people to send email on your behalf. But no, you don't want other people to send email on your behalf because there's when you want to when you want to send a newsletter out via I use drip if you have something that you forgot about, So you are Outlook.

just take a look at it. And this morning it was 0, which is good. And every now and then you get people that are like, oh, well, who the hell is this guy? You know, they market as spam and sometimes those are false positives.

they will be constantly monitoring and then

That all tracks. Cool. Yeah.

Other things,

the the main domain as Bos. I've Scott. But I don't use that to send email. I use Wes to send email and my wife uses Kate Boss.com in order

my Google Workspace, what do you want me to do with this? This Right.

Mailtrap.

like, listen, do not use So an aliases is not is that, like, a straight up Google feature? I know that I've used aliases on Google before, but is is there any sort of spec there for doing aliases outside of that? Yeah. Yeah. Like, the the whole email,

like Stripe is sending email on your behalf for receipts or something weird like that, you can go, oh, I forgot about that one. Let me adjust my SPF and DKIM records.

And that's just sending it doesn't send real email. It just sends it to a service where you can spoof the inbox.

You would not believe how many when I'm doing courses, how many times I have to be

this database path. I I'm not blurring out the keys or the database URL. Yeah. So that way you can see exactly what it looks like, but I will be deleting this the moment that this course is over. And then Yeah. People will still try to use that. And they're like, why isn't this working?

I recognize that. And then in there, you can also get a couple of spammers that are trying to send email as you as well. So you Sanity it all. You fix any issues. And the whole idea of monitoring it is email sender. So in my case, postmark that sending a piece of transactional email, what they'll do is they will add a signature to the header of your email Being DMARC aligned is a way to get

address, and that's who's actually sending the email. So if you take a look at any of my emails that are sent from West Bos, So when you send an email, They said and you're going to want to send email in several different ways. First of all, you're probably going to want to send email via email sending full demark compliance.

your demark compliance don't know what Sanity for. Probably return

spec is And then 3, reject all out. Very similar to the SPF ones. And alignment and what those you generally won't have to dip into those. Those will also allow your subdomains you're going to want you have to get this implemented. Otherwise, you're gonna be sent to spam.

there are headers and it's just like a like a Web request, like information about. And there's 2 things. There's a from address.

but it's technically being sent from Century IO. Right. Those are aliases that were just sending email as me.

It's just using the PHP mail function. Right. It's not using unless you're setting up some plug in to use WordPress.

Very interesting.

to be able to say, hey, I know I'm sending it from this server, but Same thing with with Century. Right. Like we can send email as syntax out of them, this email from Wes.

you'll see the front address is West Bos.

like if you look at the headers spammers can, Postmark,

Who do you want it to appear and it doesn't meet these strict records that I've set out, that it will be properly

Yeah. That's that's good stuff. So this isn't a 100% of staying out of the spam folder. There's whole other stuff pruning your list, frequency of sending, when you need to. So that's that's probably Node place that people aren't necessarily thinking about. So I'd certainly check for that. Awesome. Wow.

between the 2. So as your domain name. Right. So that's 1. And then you also have like transactional email. So you let email send for a couple of days and you can look at your report and say, all right, this JS a list of everyone that's sending email on my behalf. And you can look at it and say, yeah, I recognize that. I recognize that. I recognize that. And then also on that list, there will be a list of, you can. Plus, all will accept it anyway.

that's a feature that you need because sometimes you need to send it from you. You're technically sending it from 1 domain name, but you want it to visually appear as a different domain name.

But because Gmail and Yahoo actual URL.

in Sanity, DKIM.

that's why you need this pnpm DKIM and it will say, You might have a Snipkart.

approved, properly signed

needs to be able to send taking the Wes Bos Scott domain name out because we're coding along. I was like, Well, the from address is Wes at West Boston.com.

if we are sending a receipt And if you do not, if you send any type of email, whether it's just marketing email, transactional email or just from your own domain name, and these are the domain names that are allowed to send email on my behalf. So I have to include Google on there because Google is allowed to send email. But for me, I have to include Wes Postmark, and be allowed. And anything else, like if anyone else is trying to send email as you, I there's some news sender requirements They need to they have their own email service, so they need to do it. So like you generally have like at least 3 different the resend? like, transactional The Outlook possible servers to allow them to send email on your behalf. And that's Wes gonna be talking about right now. So you're ready? I'm so ready, And that's really nice. But some people were taking my course and then hooking it up to a real email SMTP service.

email on your behalf have gone so aggressive to say Wes will not

or like for my own courses, when somebody buys a course, they reset their password.

There's an update

then you can immediately tell all the other email clients to send that directly the quality as well. So they are very, very aggressive

from Denver.

let's get going here. Let's get going on this custom email stuff.

Yeah. You get better bring that SPF or else you're gonna get burned. And you also might get burned if you don't have the correct air and exception handling tracking service for your

I have written a lot of applications that send

has always been a big mystery to me.

I go to the docs.

usually just works.

software.

Excited to talk about DMARC you send an email from Syntax Data Firm.

Yeah. So

With me JS always is Wes Bos. What's up, Wes?

just accept as existing whenever you connect to your email clients and

like you,

And I'm talking about Sentry. This podcast is presented by Sentry, but, honestly, it's such a great service. If you're working with any of this stuff, you got a server, you're sending an email. It's good to know what's going on. Maybe your email's not even sending because you have a bug. And, Sentry JS gonna find that bug for you and then tell it tell you how to fix it really quick.

largely might ignore. But we're going to be talking all about what they are and how it works within your transactional

email. Yep. I've done so through many different email

So

connect your service, and send email

I go step by step. I copy and paste the things they tell me to do it, and then it

stop going to spam, DMARC, SPF, DKIM.

clients, many different email delivery Vercel,

what what is all this stuff? I know you've done a little bit of a dive here. I'm interested in hearing about, like, what all these things actually are in this whole process here. Yes. So we're gonna be talking about SPF, DMARC, and

and the part in which you get to add things to your DNS,

Wes,

email. My name is Scott Tolinski. I'm a developer

whether or not that shows up in your spam or not is up to Google

or up to Outlook or whatever email you're using. But there are several different ways that you can ensure Google workspaces because we have a custom Google workspace set up or Outlook or whatever you're using for email, for your from your domain name. Right. So Google companies that send email are extremely protective over SPF record.

and sort of whitelist passkeys. We had the 1 password folks on to talk about, from 3 different Vercel, but you all want them to be sent as your domain at Wes pieces of the email, some of the content, some of the sender details.

ways to send email I use Bos TypeScript, which is like my company, right? I just signed up as it's not someone someone goofed with it. Or the other thing is that someone just sent it from a place that was not allowed. And obviously the private key, public key luckily, it was only a couple, but you often will use services of a specific email and let me actually pull 1 up real quick. Node sec.

syntax, we use ConvertKit Mailchimp is a big one as well. There's lots of them out there.

Shopify needs to be able to send email on your behalf. Now, Postmark on there because I use Postmark for transactional email and then I have to use your DNS set up so that when you send an email as your domain name the list of allowable senders. And then that stuff was was Kim And now to take a step further, You should have both of them. There are 2 ways to verify that an email is legit.

or Syntax Data Firm. And But the that is signed with your private key.

because this is something that I think a lot of people do hit. They either get put in the spam zone It's the Node tech that we've been using forever and ever.

or syntax.

A 100 emails a day. And if you're running a full side project

That's all very interesting.

email clients can send back to you when something goes wrong. So it's called an R. U. A. And So people were there's a couple of people that had apps Gmail, Outlook, whoever is actually receiving the email,

we got a message from them. And because, like, Yeah. It's not that bad. That's awesome. And then the the the next one we have is email marketing. So if you're sending out a newsletter ESLint Syntax, you should sign up for the Syntax newsletter. By the way, go to Syntax Scott FM for SNAPBACK.

And the way that they knew that is via reporting.

So Thank you. Thank you for all this to us. Yeah. That's that's all we got. Hopefully, you enjoy that, and, we'll catch you later.

entry in your domain name is you specify an email address we also have DKIM even accept reply to address is Bos.

that's really important because

So we said, oh, yeah, that's us. So he said, okay, no problem. Let's Wes added ConvertKit to

who is allowed. Right.

another part of the demark

bad parties sending email on their behalf. So you have to be very strict and pretty much just whitelist in in this stuff. So So the first one is SPF. There's 2 different ways that you can sort of, like, validate and and guarantee that your email is being sent, SPF and DKIM, and those 2 together make up what's called which is now.

sending email as syntax Scott of them. And the next morning we had an email from I. T. And said, Hey, somebody is sending email on behalf of syntax Scott of them, and it is not in the list of allowed ways to send email. At the time, we only had allowed Google to send email from Syntax Scott of them, and now we are sending email from ConvertKit.

and DMARC aligned.

record And in my courses, we use I warp it to show up as this different, because of the way email works, And in my case, there's 6 or 7 different like you're going to see lots of spammers because spammers will use every single domain name on there. You're going to see people that are trying to Sanity email as you. And Drip, you're sort of out of luck. These public keys get added to your domain domain name via 1 of 2 ways a text record an email if you do not have is WordPress plug ins. You do a password reset on WordPress.

which IP addresses like, oh, man, like, I don't even know if I know all the different services that are going on there. So the way that it works is you set it up, you set up demark reporting But they were not And when your email passes move to demark strict and

I have to reach for customer support because I straight up Yeah. Am uneducated

if you have multiple of these services in your SPF,

to be clear,

do they all go in 1 record, 1 text record, or you do multiple text records? May only have 1

Honestly, like like me, if if I encounter a problem,

as Wes I'll give an example of telling you Wes it compliant? Was it DKIM compliant? And, same with like SSL certificate. Right. If somebody intercepts then I need you to do 1 of 3 things. 1st, none I'll check if it's SPF compliant.

or they, you know, I I feel like the the difference between transactional These are all things that you typically

and all these different types of email in your application, it can get hairy if you've never done it or haven't done it before.

what I have to do is I go into my DNS records for my domain name and I say, okay, here is my they're gonna say, like, I I sign into my postmark probably at least once a week and, or demark reject, you have to say, okay, well, like who is who am I sending emails on my behalf? Right. You might have with that type of stuff.

create a whole list of IP addresses and say these servers around the world are allowed to send email, will be able to look up your public key. So you sign it with your private key. Nobody can see that. You don't have to do any of the signing. Your email sender takes care of that, And then the receiver will get the public key But then you also have like a return if it doesn't meet either of those, ideally that meets both of them. But if it meets 1 of them, contents that are in there. There's all kinds of stuff that you can sort of play ESLint,

and SPF, 2 ways to verify that an email was sent by someone who is allowing that server to send email on their behalf.

your Wes site between your server and the browser, And

you need both of them to be clear.

Yeah. Which is it's interesting that the more we learn about a lot of these, like, security techniques,

everything ends up kind of always being just, like, public and private keys. You know? Yes.

the the contents of the email were changed okay, well, I have the public key. Let me verify that whatever the drip one is. So drip itself doesn't actually send the email. They they use another service, so you have to add that 1 on there. And what will happen with those SPF records is Yeah. So, like like, for example, ConvertKit, I don't know. Do you get it? You get, hey, your email went to spam or, hey, I never got an email from you. Check your spam. Oh, there it is. You know, and luckily now that happened to me. I've been running quarantine for about a week now. And then finally you go full go, which is reject. Right. And then you say, Okay, now I have put in place these are the 3 areas that can send email my behalf. Anything else? Anyone else that's using my email as a course thing or whatever, Right. Other things like Shopify, like if Shopify needs to send a you buy something from the Shopify store and you need to send a receipt and use your own domain name.

the public key is going to allow you to say, oh, to send email. So we have aliases But yeah, you get too many. Then that IP address starts to get

Node, and, and, and

Well, no, you don't.

So D Kim SPF and and DKIM your server's address or syntax.fm.

at some point along the Node. So it was intercepted and changed. And you can say, all right, well, when you want to And then and basically when something is not demark compliant. You set it to none. So basically you say, give me all the reports And then those emails can you can you can send them right to your inbox. But there are services out there that will compile them all and tell you how you're doing, because

that means

or adding a CNAME record. And again, you don't have to really worry about it. Your whatever service you're using will tell you, after monitoring for a couple of days, you can set it up to quarantine, which is Scott of one level stricter something.

to the email based on some pieces of the spammers can that all the IP addresses that are associated with those domain names

Hey, copy paste this thing, add it to your domain Node, and you're good to go.

It's different for DKIM, but for SPF, you may only have 1 single record, and you can add multiple, And they immediately were notified. That said because Century has a very good I. T. Security.

what to do with the emails if they don't meet send email and and literally just spoof the fact that it's coming from Wes the email clients And the demark policy is a third thing that you add to your domain Node. And it's telling will look up my domain name You receive an email from Bos And if again, if any of that data changes, then I

like merch, Scott, dotfm, alignment or compliance. So Yeah.

and check, hey, to spam or to quarantine. Then we'll talk about what the different options are. So let's start by just talking about, like, different ways that you might want to send email. You have a domain name, syntax, data from You might have, As a self certificates, It's encrypting. It's adding an encrypted header Very interesting. And I thought, like, as soon as that happened, like like, immediately, all will accept it, but it probably will go into spam or minus all. They're just going to reject it. It's not even going to go into spam. It's going to not even land in the user's inbox. It's just going to reject it all out.

Tilda

this person sent an email from this server. Was that allowed? Is that on the list of possible servers that are allowed to send email for Wes? or host names are permitted to send email on behalf of your domain name. So So we fired up the syntax domain name and we fired up a new convert kit and we started

Nice.

and your MX records to send on your behalf. You can Scott of just say include those. But unless you're sending from subdomains both from Google and Yahoo in February, So that's the first Node. Then pass keys. And Node this and it's all over the place. The one thing about this is it's it's not encrypting your email.

So I send an email to somebody with an Outlook inbox.

And if it is not, and other people that are on that service, their emails will start to affect you don't have to add those to yours. Now, at the end of that SPF record, you're going to see an all property And it's either plus all tilde, all or minus all. And those will are not going to align, and it's going to say, hey. It doesn't work.

You may also see a pnpm, SPF.

Outlook will say, Okay, Wow.

you can tell Outlook what to do with that email because you say, when we started the ConvertKit newsletter at Syntax.

do nothing a Shopify.

DKIM, someone can still send email from a domain name, and it's up to the ESLint to to catch that spam. Right now, this is where Demark alignment comes in.

And Oh, it it was hilarious. So, and DKIM.

I'll check if it's,

if anybody is sending email on my behalf the hash that was generated in the headers is is actually something that could have been generated, DKIM compliant.

that is referred to as being demark aligned.

to quarantine it. So maybe put it in the spam folder.

then it will say, all right, it's valid. We'll throw it in the inbox. But if it's not, And people were like, Okay, Wes, the from address is Wes Bos.

setup, then those emails are not gonna get to you, and you're not gonna be able to reset your password

Well, thank you. Peace.

Some external transactional email JS just sending an email via the Pnpm mail function. It's sending it straight from your server. And if you do not have

if too many emails get marked as spam from an address, does that does that hurt the IP address that it's coming from, or does that hurt the the sender?

Sanity for a couple of days and see like,

email providers are very, very concerned about who's sending email on whose behalf and spam and things like that. Yep. Is that just because

Yeah. And so I I guess the 1 question I have is I know that you said that, you know,

Gmail, anyone that accepts email will send a report back to that email address telling you what had happened, So in my courses, we send email.

like, for example, for me, when I wanted to

the Outlook, Yahoo, And if you go above a certain percentage, my courses.

and you set the the P, which is what happens that's that's standard stuff. So, again, you only have to be DKIM or they will go out to each of those domain names and find advise the receiver

one funny thing that popped up was

And if it's not,

identified mail. And what it does is it adds a public key to your DNS records to allow email receivers to verify your outgoing sign email. So what does that mean? Well, public key, private key, we've talked about it in the past. I'm not going to go super deep into it, but as? immediately it will reject and you have Node, strong, blacklisted Wes, do you? of your PHP server in your, Hey.

domain keys and was it DMARC aligned?

Then the receiver, but I probably have 5 or 6 different things that were sending email on my behalf. And I was spam complaints against your emails.

your

given that we now have the public key.

and Kim is stands for is you should certainly check it in the one place this is going to be a problem for a lot of people that they're probably not thinking about

All about And so

email.

Welcome to Syntax on this Monday Sanity treat. We're gonna be talking about