Are SPF and DKIM records needed when the SMTP IP is marked as a subscriber block?

Question

I have been searching around, but not sure of all the facts I need. Let me explain.

I have stayed out of the SMTP game for a while and have become ignorant of the newer developments.

Prior to my current IP address, it was a commercial IP address from a Sprint pool out of Florida. It was never challenged when I sent e-mails. But since CenturyLink has taken over Embarq after the merge with Sprint (land line), my DSLAM was changed and the IP address updated to a subscriber line (which I am paying for I assure you - another fight for another day). Since then, I have only sent two e-mails and both to Yahoo! addresses - one just a while ago. The first one failed because I was using my internal DNS for some funky stuff and it needed resetting. I am now using CenturyLinks DNS. However, I never set up SPF and DKIM and though I should.

Okay. That is a lie. I just set up a SPF record - after sending the e-mail. Smart huh? However, while poking around my server, DKIM is not installed and therefore not available at this point. And I am thinking, "Sheesh! Do I really have to do this?"

And that is my question to you. Since my server worked fine before, I am sure I need more today. Is the SPF record enough for Yahoo!, GMail, and others?? Do I really need DKIM? I ask this keeping in mind that there are blacklists that list my IP address block as a subscriber block. This is what would stop my e-mail from going through with some larger ISPs normally and why I never worked too hard. This is an important fact. I need to negate enough negative scores that the subscriber check may not matter if at all possible. Not sure it is.

I would not care except that two of my friends are on Yahoo! and I just responded to one today. As well, being a Landlord that is advertising on apartments guide, rentals, and other online sites, I noticed that all users so far are using Yahoo! and GMail. Nor do I blame them!! So I guess I should care a little.

[Update]

As it turns out, my e-mail was accepted by Yahoo!, however, I cannot say whether it went into a spam bucket or not. I do not have a notice from Yahoo! saying if my e-mail is rejected as spam or otherwise. I am still concerned with Yahoo! and other e-mail services such as GMail. I almost never send e-mail, but when I do it is often very important.

Answer 1

While every domain should have SPF configured in the DNS records to identify the servers that are allowed to send emails for the domain I doubt that adding DKIM will make a huge difference as you are currently operating from a subscriber block. DKIM is only meant to authenticate that the emails have not been changed since they left the original mail server. The issue here is that even if the IP address is not listed on any blacklists many mail service operators are reluctant to accept emails from servers running on consumer address blocks, especially of a pointer record has not been set up for the IP address in question to associate its reverse DNS listing as being on your domain as well, as the general feeling is that a consumer block shouldn't be used for hosting email servers.

In your situation closetnoc it is really difficult as from the sounds of things you are restricted on the address you can be assigned. Ideally you would have a business IP assigned with matching forward and reverse DNS entries.

But in answer to the original point of the question which I took to be do you really need DKIM it has to be an assessment made by yourself. Ideally every mail server will have SPF and DKIM set up but realistically I don't see DKIM improving your chances of an email being allowed through gmail and yahoo filters and into the main inbox.

Answer 2

I'd say DKIM is definitely a value adder in this scenario!

Different ESPs have different ways of handling block / black lists. However, email authentication is gaining traction.

Apart from the proof that some headers within a message were not modified in transit, DKIM is also used as a means of proving domain ownership AND as a tool for receiving parties to build a reputation (on the domain DKIM is being signed with, so the header.d value).

Add to that a DMARC policy that will tell the receiving server to reject (or quarantine) a message if authentication via SPF or DKIM fails, this is a very strong sign that you are in control of your domain.

Mostly if I do, it is to my research partners which are also using subscriber lines and we white-list our domains.

Whitelisting domains opens up a gap that will allow for Phishing to pass through. If this is a targeted attempt, they might just know which domains to impersonate.