simon360/simonandrews.ca

Code for https://simonandrews.ca, built using Next.js

simonandrews.ca's Issues

Using `-all` may not be the best idea

Using -all may not be the best idea according to:

https://stackoverflow.com/questions/64495457/all-all-and-all-in-dns-spf-configuration

The "right way" is to use a ~all default, and to configure your DMARC record to require both DKIM and SPF "pass" results.

Documentation is incorrect about DKIM enforcing From header/Envelope MAIL FROM match

Hi,

Your documentation looks great, that's nice of you to have clarified many points for people who might be lost.
If I may, there are a few approximations and false statements though, notably in your description / understanding of DKIM.

DKIM does not enforce in any way Envelope MAIL FROM should match the From header.

In fact, DKIM is a signing system enabled on an authorized sender MTA for a domain name, designed to authenticate the contents of an email (and part of its headers). When an mail server handles an email for a a domain it has signing domain keys for, it will add a new DKIM-Signature header, which will allow a receiving MTA to confirm some parts of the email are authentic and have not been tampered with (usually including the From header).

• SPF acts as an authorization system
• DKIM as a content authentication system
• DMARC as an authorization system based on both

Cheers