Where to place the SPF records and Google Apps DKIM on a multidomain website?

Question

We're having issues with spam filters with our emails. They're not being received by our clients about half of the time. We decided to make sure the SPF and DKIM are correctly set.

Suppose I have a hosting with some external domains purchased and linked here.

Now, suppose that we're externalising the email management to Google Apps, where we have the main domain as the only company domain, but are also using secondary domains from Gmail, and directly contacting the hosting SMTP server. Others are simply domains purchased that act as an alias of the main domain (though inside the GMail accounts they aren't considered as Alias).

With that in mind, I'm having a huge trouble making this work. This is the current situation:

• Emails sent with the main domain are correctly authenticated.
• Emails sent with hosting-stmp handled might not be authenticated, but seem to work well.
• Emails sent with "aliased" accounts are sent, but via main domain.

I've set include:_spf.google.com as a SPF in the hosting panel, per domain. But to which servers should I add the DKIM from Google Apps? To the main domain, all of them? I've set it to the main domain and it seems to work as always.

Answer 1

If you add DKIM on the main domain to your Google Apps they will generate the DKIM key for you and give you a public-side to add to the DNS. You will not have access to this private-key and will not be able to sign messages with said key on an external mail gateway.

If you have a designated, external domain for sending email make sure that domain has, for itself, proper SPF records as well as DKIM configuration on the mail-gateway and configured in the DNS.

Here is a handy tool that and test: https://www.mail-tester.com/spf-dkim-check

If mail is still not received by your clients then check your mail-gateway logs, perhaps there is a connection error or you may have bounce-back messages in your mail system describing delivery errors.

I've found it's also handy to process my pending marketing messages through SpamAssassin to see what it grades them as.