Outgoing Filtering - SPF & DKIM

Business / Enterprise Security Products & Services Comodo AntiSpam Gateway - Hosted Anti Spam Service
1

Hello,

First of all Happy Holidays and thanks for this amazing product!

I used the Exim/cPanel Smarthost guide to configure my cPanel server to send all outgoing email via CASG (it’s a single domain cPanel server) and use IP authentication to do so. Everything works fine as far as I can tell.

I have a couple of questions regarding SPF & DKIM.

  1. SPF:
    Your guide mentions that I need to add
mxsrv1.spamgateway.comodo.com
mxsrv2.spamgateway.comodo.com

to my SPF whitelist.

Is this the A record or MX record whitelist?

My SPF record currently looks like this:

v=spf1 +a +mx +ip4:xxx.xxx.xxx.xxx +mx:mxsrv2.spamgateway.comodo.com +mx:mxsrv1.spamgateway.comodo.com ~all

is this correct or should it be:

v=spf1 +a +mx +ip4:xxx.xxx.xxx.xxx +a:mxsrv2.spamgateway.comodo.com +a:mxsrv1.spamgateway.comodo.com ~all

?

  1. DKIM:
    How can I setup DKIM with CASG? I currently have two DKIM TXT records, one generated by the cPanel server, and one by Mandrill (which I use to send outgoing mail from our CMS). Is there a way to generate a DKIM certificate for CASG so I can add it to my DNS records?
2

Hi George,

As to the SPF, this may be useful…

mxsrv1.spamgateway.comodo.com. IN TXT “v=spf1 ip4:178.33.199.65 -all”
mxsrv1.spamgateway.comodo.com. IN SPF “v=spf1 ip4:178.33.199.65 -all”
mxsrv2.spamgateway.comodo.com. IN TXT “v=spf1 ip4:178.33.199.66 -all”
mxsrv2.spamgateway.comodo.com. IN SPF “v=spf1 ip4:178.33.199.66 -all”

Let me get back to you on the DKIM question though.

Regards,
Michel.

3

Thanks Michel,

I guess the correct SPF record will look like this:

v=spf1 +a +mx +ip4:[server IP] +a:mxsrv1.spamgateway.comodo.com +a:mxsrv2.spamgateway.comodo.com ~all

I’ve been using the above for the past 36 hours and had no issues at all :-TU

4

Hi,

To your DKIM question…

Manual creation of a DKIM certificate is do-able, but this would mean that every outgoing user/IP address would require a specific property to be set for that user/IP.

An automated version of setting this property is something we are working and hope to have accomplished by the end of February this year.

Kind regards,
Michel.