Publish DNS records so your email is trusted

• You need access to the DNS zone of your domain — usually at your registrar or DNS host.
• Get the exact values from whoever sends your mail: your SMTP provider publishes them, and they differ per provider.
• Changes to DNS take minutes to hours to propagate. Plan for the wait instead of re-editing the record.

This documentation presents three complementary authentication protocols (SPF, DKIM, and DMARC) used to prove the legitimacy of an email sender. Not complying with these protocols will greatly reduce chances of your emails to reach their destination.

If choosing to use a custom domain instead, configuring SPF and DKIM records correctly is essential to prevent emails from being quarantined as spam or not being delivered to recipients.

If using the default WindoorERP email server to send emails from a custom domain, the SPF and DKIM records must be configured as presented below. If using an outgoing email server, it is required to use the SPF and DKIM records specific to that email service and a custom domain.

The Sender Policy Framework (SPF) protocol allows the owner of a domain name to specify which servers are allowed to send emails from that domain. When a server receives an incoming email, it checks whether the IP address of the sending server is on the list of allowed IPs according to the sender's SPF record.

In WindoorERP, the SPF test is performed on the bounce address defined under the Alias Domain field found under the database's General Settings. If using a custom domain as Alias Domain, it is necessary to configure it to be SPF-compliant.

The SPF policy of a domain is set using a TXT record. The way to create or modify this record depends on the provider hosting the DNS zone of the domain name.

If the domain name does not yet have an SPF record, create one using the following input:

If the domain name already has an SPF record, the record must be updated. Do not create a new one, as a domain must have only one SPF record.

Check the SPF record using a tool like MXToolbox SPF Record Check. The process to create or modify an SPF record depends on the provider hosting the DNS zone of the domain name. The most common providers and their documentation are listed below.

The DomainKeys Identified Mail (DKIM) allows a user to authenticate emails with a digital signature.

When sending an email, the WindoorERP email server includes a unique DKIM signature in the headers. The recipient's server decrypts this signature using the DKIM record in the database's domain name. If the signature and the key contained in the record match, it proves the message is authentic and has not been altered during transport.

Enabling DKIM is required when sending emails from a custom domain using the WindoorERP email server.

To enable DKIM, add a CNAME record to the DNS zone of the domain name:

The way to create or modify a CNAME record depends on the provider hosting the DNS zone of the domain name. The most common providers and their documentation are listed below.

Check if the DKIM record is valid using a tool like MXToolbox DKIM Record Lookup. Enter example.com:odoo in the DKIM lookup tool, specifying that the selector being tested is odoo for the custom domain example.com.

The DMARC record is a protocol that unifies SPF and DKIM. The instructions contained in the DMARC record of a domain name tell the destination server what to do with an incoming email that fails the SPF and/or DKIM check.

There are three DMARC policies:

• p=none
• p=quarantine
• p=reject

p=quarantine and p=reject instruct the server that receives an email to quarantine that email or ignore it if the SPF or DKIM check fails.

Passing DMARC generally means that the email will be successfully delivered. However, it's important to note that other factors like spam filters can still reject or quarantine a message.

p=none is used for the domain owner to receive reports about entities using their domain. It should not impact the deliverability.

DKIM signs each message. The receiving server fetches your public key from DNS and verifies the signature, which proves the message is yours and was not altered on the way.

1. Get the selector and key from your mail provider. It is usually a CNAME to publish, sometimes a TXT record containing the key itself.
2. Create it in your DNS zone exactly as given — selector names are case-sensitive and must match what the sender signs with.
3. Verify with a DKIM lookup tool, entering yourdomain.com:selector.

Send one real email from your database to a tool such as Mail-Tester. It scores the content and every authentication record in one go, which is faster than checking each record separately and guessing about the rest.