DKIM: temperror
WordPress core has been updated automatically today, so I got an email that was sent via PHPMailer in WordPress.
I looked at the email header and found this error:
++++++++++++++
list of top cheapest host http://Listfreetop.pw
Top 200 best traffic exchange sites http://Listfreetop.pw/surf
free link exchange sites list http://Listfreetop.pw/links
list of top ptc sites
list of top ptp sites
Listfreetop.pw
Listfreetop.pw
+++++++++++++++
Code:
Authentication-Results: mx.google.com; dkim=temperror (no key for signature)
header.i=@server.examplehost.com header.s=default
So I thought there was something wrong and contacted my web host.
They said everything is fine, it's the default behavior of the server.
What I don't quite understand:
The message contains a DKIM Signature:
Code:
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=server.examplehost.com; s=default;
etc.
But they don't provide a public key. Here's the output from dkimvalidator.com:
Code:
Public Key DNS Lookup
Building DNS Query for default._domainkey.server.examplehost.com
Retrieved this publickey from DNS:
Validating Signature
result = invalid
Details: public key: not available
They say that's the default behavior of the server.
I find that strange, but maybe I'm wrong, please correct me if that's the case.
Code:
dkim=temperror (no key for signature)
... and
Code:
Details: public key: not available
That's really really clear. You have no DKIM public key published for
default._domainkey.server.examplehost.com -- or if you do, it couldn't find it.
Daddy? How was vi born?
Well son, first cat and echo fell in love...
Yes, I know.
The thing is, it's not about my domain name, it's about the domain name of their server, that's what's in the email header--so I can't do anything about it.
So they don't have published a public DKIM key, but they say everything is fine. That's why I'm confused.
Well, yes, there is. You contact them and ask them why they're signing your emails with a broken DKIM and could they kindly either fix it, or knock it the hell off.
Alternatively, stop worrying about it.
Having a valid DKIM improves deliverability - but not having any DKIM at all (which is effectively the case here) does not hurt deliverability any either.
Daddy? How was vi born?
Well son, first cat and echo fell in love...
I'm not entirely sure if they didn't understand my question or if effectively having this configuration with no public key but a signed email is really their default configuration and they think that's OK.
I suggested to my web host that I still think there's something wrong, but if they're really sure that's OK then they can close the ticket. They closed the ticket. Maybe I should reopen it.
It sounds like php mail / sendmail is in use and mail servers are seeing user@server.example.com as the from and not the from you expect it to be . Is their domain in the from header or x-sender header and the address is like ftpuser@server.example.com ? If so, double check the phpmailer is setting the from address correctly. Also, check that phpmailer is using SMTP authentication instead of the php mail .
You need to change your script sending to smtp and if possible, use the secure port.
You also need to validate your domain not the server's hostname.
You can use a plugin like the one below to send your email by SMTP instead.
Thank you, everyone, for your input. I think I'll just leave it as it is right now.
As SneakySysadmin said, not having any DKIM at all is also OK.
And I could always use a plugin like WP Mail SMTP and for example Mailgun later on.
header.i=@server.examplehost.com header.s=default
What type of hosting are you using? (Shared, VPS, Server)
Are there any other users of this website? Blogs? Comments? WooCommerce?
Does the website send out any newsletters?
If you're the only person that these emails are sent to, then you don't have to worry. If the website has to send emails to other people, then it can become a serious issue as those emails may always land in spam and put that IP on a Blacklist. Alerts from PHP mail are fine if its the occasional email, but it's still better practice to use a SMTP plugin.
A tempfail means that DKIM will be effectively ignored by recipient systems. Some super-anal admin somewhere might decide out of the blue to block emails that tempfail, but no competent admin or spam filtering system will bat an eye at that.
A tempfail is the same as not having DKIM at all. They are very highly unlikely to affect spam scoring one way or the other.
Daddy? How was vi born?
Well son, first cat and echo fell in love...
I just wanted to understand the configuration, it seemed a bit weird to me. It's OK for these emails I guess, so I'll leave it how it is.
It is weird. No server should be signing every email that's sent with an unpublished key. It's not just weird it's bloody stupid - and you can tell your host I said so.
I doubt very much this is hurting your deliverability, but there are always edge-cases and worse, paper-mill certified "administrators" that don't know how to configure their spam filtering who will decide they know better than the RFC and will decide to penalize emails that tempfail on DKIM... so while I doubt this is hurting you any the fact remains that it could.
Your host should not be signing emails unless it has valid keys with which to do so. They should be signing with valid data, or not signing at all - with no in-between.
Daddy? How was vi born?
Well son, first cat and echo fell in love...
no competent admin or spam filtering system will bat an eye at that.
Quote Originally Posted by SneakySysadmin View Post
and worse, paper-mill certified "administrators" that don't know how to configure their spam filtering who will decide they know better than the RFC and will decide to penalize emails that tempfail on DKIM
Enter Yahoo, MSN, and small ISP with trigger happy backwards filters. Yahoo should have been brought behind the barn shed at least 16 years ago. Last time I used, their highest spam filters would allow 500 junks mails a day into the inbox. It was only a backup account to save contacts, which everyone on the list ended up with Malware emails, so I closed it. If something just seems slightly off with a company email, instant block from Yahoo and MSN. Everything could be set properly for the sender and they will still find a reason to have an issue with it, which is ironic for Yahoo especially since they still send out Malware.
Interesting to see so "non-caring" fortitudes towards DKIM and the thought that DKIM does not have an effect on deliverability. I know of a lot of companies that interrogate DKIM signatures - we even do it which has sometimes caused deliverability issues from external senders to the GovCloud. However, I do think that's the difference; you'll probably run into issues sending to an organization using Government boundaries; we had a problem long ago when negotiating with LiquidWeb that caused issues until they were filtered to have DKIM completely ignored.
Ordinarily, if DKIM fails validation there are plenty of other parts of the header that are used for validation and nearly every company we work with on a regular basis has a DMARC record making it easier to authenticate valid emails.
For the average Jane and Joe and for most hosting companies, I am actually not certain what the stance is on DKIM but it appears to be up for debate. Nonetheless, most modern email systems outside of GovCloud (or equivalent) check DKIM and behave accordingly to how it is specified within the standard (GMail is an example).
Personally, I would get the DKIM records properly addressed nonetheless.
Interesting to see so "non-caring" fortitudes towards DKIM and the thought that DKIM does not have an effect on deliverability.
Exactly no one has said any such thing, in fact just the opposite - so perhaps you should start over.
Quote Originally Posted by NortheBridge View Post
Ordinarily, if DKIM fails validation
Difficulty: DKIM did not fail validation.
temperr != "fail"
Temporary errors can be caused by almost anything, on either side of the email - which is why temporary errors are not considered a failure of validation.
Quote Originally Posted by NortheBridge View Post
Nonetheless, most modern email systems outside of GovCloud (or equivalent) check DKIM and behave accordingly to how it is specified within the standard (GMail is an example).
Indeed they do, and they do it properly too - exactly as the standard says it should, which is why GMail cheerfully accepted the email that started this thread.
Personally, I would get the DKIM records properly addressed nonetheless.
Once again, please re-read the thread.
Daddy? How was vi born?
Well son, first cat and echo fell in love...
Temporary errors can be caused by almost anything, on either side of the email - which is why temporary errors are not considered a failure of validation.
Indeed they do, and they do it properly too - exactly as the standard says it should, which is why GMail cheerfully accepted the email that started this thread.
As sad as it is, Gmail just works and has "the right" settings.
Reading all of this reminded me a situation a few months ago. A new client needed information sent to him, which I did. No reply. I later found an email from those systems that you have to validate your email in order to send emails to the person. I did the validation and everything was back on schedule. Guess where the validation email was? In the spam folder. I don't recall what it was but that service in front of his emails had an issue within the header. Who knows how many emails or business opportunities were lost for him and others using that service.
As sad as it is, Gmail just works and has "the right" settings.
Truth - and I did caveat myself earlier that there are always going to be edge cases that do not understand what "temporary error" truly means who will decide they know better and filter against it.
Those are going to be decidedly rare however, so rare that they're probably not worth worrying about.
Should the OP get this fixed? Certainly.
Is it cause for a three-alarm fire? Nope.
Daddy? How was vi born?
Well son, first cat and echo fell in love...
domain group
make money xenoblade 2
hosting meaning
hosting website from home
toi96.top
s domain to time domain
trv24.atspace.com
60s host andy
make money dropshipping
arb4car.com
www.magichits.eu
