Gmail requires all senders to authenticate with either SPF or DKIM.

To successfully send emails to Gmail (and many other email providers), you need to authenticate your emails using SPF (Sender Policy Framework) and/or DKIM (DomainKeys Identified Mail). These authentication methods help verify that the email is coming from a legitimate source and reduce the chances of it being marked as spam.

Here's how to set up SPF and DKIM for your domain:

Step 1: Set Up SPF

1. Create an SPF Record:
   • An SPF record is a type of DNS TXT record that specifies which mail servers are allowed to send email on behalf of your domain.

   • The record might look something like this:

     v=spf1 a mx ip4:YOUR_SERVER_IP -all

   • Replace YOUR_SERVER_IP with the actual IP address of your mail server.
   • This record means:
     • v=spf1: This indicates it's an SPF record.
     • a: Allows the domain’s A record IP to send mail.
     • mx: Allows the domain's MX servers to send mail.
     • ip4:YOUR_SERVER_IP: Authorizes your server's IP to send emails.
     • -all: Indicates that all other sources are not allowed to send emails on behalf of your domain (hard fail).
2. Add the SPF Record to Your DNS:
   • Log in to your domain registrar or DNS hosting provider.
   • Navigate to the DNS management section.
   • Add a new TXT record with the SPF record you created.

Note that you can add multiple ip addresses

• Here’s how to format an SPF record with multiple IPv4 addresses:

  v=spf1 ip4:192.0.2.1 ip4:203.0.113.2 ip4:198.51.100.3 -all
  

  Breakdown of the Record:

  • v=spf1: This specifies the SPF version being used (in this case, SPF version 1).
  • ip4:192.0.2.1: Authorizes the IP address 192.0.2.1 to send emails for your domain.
  • ip4:203.0.113.2: Authorizes the IP address 203.0.113.2 to send emails.
  • ip4:198.51.100.3: Authorizes the IP address 198.51.100.3 to send emails.
  • -all: This indicates a hard fail for any IP not listed (you can use ~all for a soft fail if you want to allow some flexibility).

• Example for IPv6

  If you also need to include IPv6 addresses, you can do it like this:

  v=spf1 ip4:192.0.2.1 ip4:203.0.113.2 ip6:2001:db8::1 ip6:2001:db8::2 -all

• Using Subnets
  You can also specify subnets using CIDR notation. For example, to authorize an entire subnet, you can do the following:

  v=spf1 ip4:192.0.2.0/24 -all
  

  This will allow any IP address from 192.0.2.0 to 192.0.2.255 to send emails for your domain.

• Combining with Other Mechanisms
  You can also combine IP addresses with other SPF mechanisms like mx, a, or include.
  For example:

  v=spf1 ip4:192.0.2.1 mx include:example.com -all
  

  This means:

  • Allow the IP address 192.0.2.1.
  • Allow any IP address from the domain’s MX records.
  • Include the SPF record from example.com.

Step 2: Set Up DKIM

1. Generate DKIM Keys:
   • You can generate DKIM keys using various tools or libraries. If you’re using Postfix with Dovecot, you can use OpenDKIM to create DKIM keys.

   • Install OpenDKIM:

     sudo yum install opendkim opendkim-tools -y

2. Configure OpenDKIM:

   • Open the configuration file:

     sudo nano /etc/opendkim.conf

   • Add or edit the following lines:

     Syslog          yes
     Umask           002
     Mode            sv
     Canonicalization     relaxed/simple
     SubDomains      no
     # Replace 'example.com' with your domain
     Domain          example.com
     KeyFile         /etc/opendkim/keys/example.com/default.private
     Selector        default
     

   • Create the key directory:

     sudo mkdir /etc/opendkim/keys/example.com

3. Generate the DKIM Key Pair:

   sudo opendkim-genkey -s default -d example.com
   sudo mv default.private /etc/opendkim/keys/example.com/
   sudo mv default.txt /etc/opendkim/keys/example.com/

4. Add DKIM Public Key to DNS:
   • Open the generated default.txt file in the /etc/opendkim/keys/example.com/ directory. This file contains the DKIM public key.
   • Copy the entire contents of this file (it starts with v=DKIM1;).
   • Go to your DNS management interface and create a new TXT record:
     • Name: default._domainkey.example.com (replace with your domain)
     • Type: TXT
     • Value: Paste the contents of the default.txt file.
5. Configure Postfix to Use OpenDKIM:

   • Edit the Postfix main configuration file:

     sudo nano /etc/postfix/main.cf

   • Add the following lines:

     milter_protocol = 2
     smtpd_milters = unix:/var/run/opendkim/opendkim.sock
     non_smtpd_milters = unix:/var/run/opendkim/opendkim.sock

6. Start and Enable OpenDKIM:

   sudo systemctl start opendkim
   sudo systemctl enable opendkim

7. Restart Postfix:

   sudo systemctl restart postfix

Step 3: Verify SPF and DKIM

Once you’ve set up SPF and DKIM:

1. Verify DNS Records: Use tools like MXToolbox to check if your SPF and DKIM records are correctly set up.
2. Send a Test Email: Send an email to your Gmail account and check the email headers. You should see entries for both SPF and DKIM in the headers, indicating they are passing.

Conclusion

Setting up SPF and DKIM properly helps improve email deliverability and reduces the chances of your emails being marked as spam, especially by Gmail. If you encounter any issues during the setup process, feel free to ask for help!