Greenby email server setting DKIM

[#1]

I am referring to the setting reached by the Greenby portal > Email > Settings, described as: 

DKIM signs your email with a secure key, this identifies you as a legitimate sender for your email address. This ensures that your email address is less likely to be spoofed, and improves delivery rates with other email providers. If we manage your DNS then this is setup automatically for you. However if you manage your own DNS, you can manage your DKIM settings below.

Default setting seems to be 'off', and I have left it alone because I don't fully understand it. I only know that it is to do with authenticating email sending and have seen this mentioned from time-to-time, but by people who have their own domain. 

Is is recommended to turn this on? My email address is the default <name>@<user>.plus.net and I don't manage any domains or stuff like that. 

I am just wondering if it helps at all with the deluge of spam that I get ever since the migration (which do go into the junk folder now but a PITA to check through), or if it helps with the random fails we get sending to Microsoft or Apple accounts that seem to get fixed on occasion for a while before being dropped again. 

I have migrated for a couple of months now, but whilst things seem to mostly work, the entire email experience just seems worse in every possible way compared to before. IMAP often times out or just take ages, including using the webmail - it's just darn slow a lot of the time. I guess I'm not really sure if changing any of the Greenby default settings might improve things. The only thing I have tweaked with so far is the Anti-spam aggression setting. 

Thanks in advance.

Simon

[#2 · Accepted solution]

---

@SimonC1

"I am referring to the setting reached by the Greenby portal > Email > Settings, described as: "

If you don't run your own DNS, domain and email addresses but use the standard Plusnet addresses via Greenby email then, as they say, it is all handled by Greenby themselves. So turning the DKIM setting ON/OFF won't change anything AFAICS.

"I am just wondering if it helps at all with the deluge of spam that I get ever since the migration"

WRT incoming Spam, this is another matter entirely! It may possibly relate to DKIM/SPF settings in the originating domain the Spam is coming from - and how the Greenby systems handle incoming messages - but none of this is under the direct control of the ordinary Greenby email user receiving Spam.

Again, I don't doubt the reports of Spam from users of Plusnet email and how many blame it on the transition to Greenby . However, I can only point out there is another side to this. I have not to date received any Spam since the transfer to Greenby. But then (normally) I didn't get any Spam when I was still with Plusnet email. So, whatever the cause of recently reported increase in Spam by some people it seems to me that it must be mainly user based. In other words, if you are getting a lot of Spam it is because your email address is on Spammers lists of email addresses. The question then is: How did this come about? Obviously I don't know! However, I have noticed more than one person on here complaining about Spam asking: "Please stop all the Spam coming to my email address <MyEmailName>@<username>.plus.com".

While I can't know why they are receiving Spam (and I am not) I'd be prepared to make a guess or two... 🤔

"IMAP often times out or just take ages, including using the webmail - it's just darn slow a lot of the time."

Yes it is. Other times it's perfectly OK. Right or wrong, I put this down to the demands on their servers running scripts transferring the Plusnet (and other) email accounts over to Greenby. So I give them a pass on that for now, assuming things will become steadier once the job is completed. We will have to wait and see.

[#3]

In bound spam

We are using an MS Outlook rule to detect spam flags in the message header. 95% of spam is being moved to a Junk / Spam folder. It took a bit of effort to review the email headers and to find the spam filter's flags below are examples :

spf=fail   
spf=softfail
dmarc=fail
dkim=fail
BAYES_SPAM(5.
HFILTER_HOSTNAME_UNKNOWN
RDNS_NONE
.click
.shop


So turning the DKIM setting ON/OFF won't change anything AFAICS.

In this thread from last week I posted about what happens if DKIM is enabled in the Greenby portal,
and it is not nothing :

https://community.plus.net/t5/Email/Greenby-email-catch-all-setting/m-p/2046639#M60870

[#4]

@PhilipHeyes 

"In this thread from last week I posted about what happens if DKIM is enabled in the Greenby portal,
and it is not nothing :"

I cannot see how, unless you have access to the DNS for an email server's domain, you can control the DKIM for that domain. For the typical Plusnet user who simply has a Plusnet email address - now with Greenby - I cannot see how this would be true. So AFAICS what Greenby say makes sense:

"DKIM signs your email with a secure key, this identifies you as a legitimate sender for your email address. This ensures that your email address is less likely to be spoofed, and improves delivery rates with other email providers. If we manage your DNS then this is setup automatically for you. However if you manage your own DNS, you can manage your DKIM settings below."

https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

"DomainKeys Identified Mail (DKIM) is an email authentication method that permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message."

I can try sending myself an email - to another email account - from my Greenby account, with the Greenby portal DKIM setting ON and then OFF to see what happens.

[#5]

"In this thread from last week I posted about what happens if DKIM is enabled in the Greenby portal,
and it is not nothing :"

If you enable DKIM in the Greenby portal then (unless using relay.plus.net) the Greenby server will DKIM sign the outgoing email. However, since the DKIIM public key isnt present in the sending domain DNS, a receiving server cannot check the DKIM signature. 

So effectively DKIM still fails , but for a different reason. When not enabled the receiver reports no DKIM signature, when enabled it reports an error looking up the DKIM key to check the signature.

[#6]

i only use greenby webmail 

but daily get  " you pervert " emails in my junk folder coming from my OWN email address

Greenby says DKIM is included but is that the same as the things they tell you to do,

Whitelists or Blacklists or telling its not spam for good emails ALL OF WHICH DO NOT WORK.

I have had basic emails to hotmail and iclouud bounced back, i now have to text family members that i have emailed them

to get a reply nothing their end , i then copy and paste message into my freebie AOL account and its there immediately

and i dont have to sit there for ages watching it loading or refreshing on ( watching paint dry Greenby really slow )

that really is progress ?

kenm

[#7]

Time for Plusnet and Greenby to knuckle down and come with a way for Greenby
to update the <account>.plus.com DNS records for migrated emails.

[#8]

I will leave my settings alone then. Normally I assume the defaults for things are all fairly sensible (but always worth a look through!) but with all the things that I read about here, my confidence with Greenby isn't that great, so thought worth asking to get advice from those more knowledgeable than myself. 

Thanks pvmb for answering each of my points in turn. I am aware spam will be down to my address being on some list rather than Greenby's fault specifically. It's just that Plusnet had always been pretty good at blocking all the really obvious stuff (e.g. the You Pervert that a number of us seem to be getting in huge numbers). They get filtered out even before reaching my junk folder stage.

I had expected that whatever Plusnet had to do this would had carried over, but it feels like Greenby is like a first-time email service provider and starting from scratch. I know they were spun up as a company just for this, but I think they are a part of an existing email service provider so expected a better baseline service. At least the spam folder seems somewhat trainable via the webmail interface, but the blacklists / whitelists don't seem to work. My PlusNet email is used mostly to receive important emails, rather than for sending regularly, but the various issues and the on-and-off MS/Hotmail/Outlook rejection is worrying. 

Thank you all for the replies, and MisterW as always chiming in to explain how the technical bits (should) work. 

[#9]

---

@pvmb wrote:

I can try sending myself an email - to another email account - from my Greenby account, with the Greenby portal DKIM setting ON and then OFF to see what happens.

---

Duly done, both messages received OK (Not Spam). There are differences, but what to make of them?

Too much information! However, here are heavily edited extracts from the message headers - differences highlighted:

DKIM ON:

Authentication-Results: btinternet.com;
 dmarc=pass header.from=<Username>.plus.com;
 dkim=permerror;
 spf=none smtp.helo=kathleen.gateway.enmail.co;
 spf=pass smtp.mailfrom=<Username>.plus.com;
 arc=none smtp.remote-ip=91.204.211.107
 Received-SPF: none (btprdrgi034.btinternet.com: domain
 kathleen.gateway.enmail.co does not designate permitted sender hosts)
 identity=helo; receiver=btprdrgi034.btinternet.com; client-ip=91.204.211.107;
 helo=kathleen.gateway.enmail.co;
 Received-SPF: pass (btprdrgi034.btinternet.com: domain <Username>.plus.com
 designates 91.204.211.107 as permitted sender) identity=mailfrom;
 receiver=btprdrgi034.btinternet.com; client-ip=91.204.211.107;
 envelope-from=<EmailName>@<Username>.plus.com; helo=kathleen.gateway.enmail.co;

DKIM OFF (Default):

Authentication-Results: btinternet.com;
 dmarc=pass header.from=<Username>.plus.com;
 dkim=none;
 spf=none smtp.helo=anduin.gateway.enmail.co;
 spf=pass smtp.mailfrom=<Username>.plus.com;
 arc=none smtp.remote-ip=<My Plusnet IP>
 Received-SPF: none (btprdrgi038.btinternet.com: domain
 anduin.gateway.enmail.co does not designate permitted sender hosts)
 identity=helo; receiver=btprdrgi038.btinternet.com; client-ip=<My Plusnet IP>;
 helo=anduin.gateway.enmail.co;
 Received-SPF: pass (btprdrgi038.btinternet.com: domain <Username>.plus.com
 designates <My Plusnet IP> as permitted sender) identity=mailfrom;
 receiver=btprdrgi038.btinternet.com; client-ip=<My Plusnet IP>;
 envelope-from=<EmailName>@<Username>.plus.com; helo=anduin.gateway.enmail.co;

PS.  [91.204.211.107] is the host kathleen.gateway.enmail.co

[#10]

There are differences, but what to make of them?

Seeing a dkim header fail with : dkim=permerror;   is worse than :  dkim=none;

Hence I have kept DKIM OFF and await the time when this setting works as required.

[#11]

Why does turning dkim on/off via greenby alter the stmp remote ip and client ip? Shouldnt this be outgoing mail server ip?

[#12]

---

@PhilipHeyes wrote:

Time for Plusnet and Greenby to knuckle down and come with a way for Greenby
to update the <account>.plus.com DNS records for migrated emails.

---

"update the <account>.plus.com DNS records"? Is that even practical? (I don't know). Surely it's only the DNS records for the .plus.com domain that counts?

@PhilipHeyes wrote:

"Seeing a dkim header fail with : dkim=permerror; is worse than : dkim=none;

Hence I have kept DKIM OFF and await the time when this setting works as required."

I have been wondering about lines such as these:

DKIM ON:

dmarc=pass header.from=<Username>.plus.com;
dkim=permerror;

arc=none smtp.remote-ip=91.204.211.107

Received-SPF: pass (btprdrgi034.btinternet.com: domain <Username>.plus.com
designates 91.204.211.107 as permitted sender) identity=mailfrom;

DKIM OFF (Default):

dmarc=pass header.from=<Username>.plus.com;
dkim=none;

arc=none smtp.remote-ip=<My Plusnet IP>

Received-SPF: pass (btprdrgi038.btinternet.com: domain <Username>.plus.com
designates <My Plusnet IP> as permitted sender) identity=mailfrom;

Q. Is <Usename>.plus.com a 'Fully Qualified Domain name', where in effect <Username> is treated simply as the name of a host in the plus.com domain. Or is it in its entirety being treated as a (email) domain? Is this consistently handled by email servers etc? I don't know.

[#13]

Is smtp.remote-ip= with dkim on/off when not connected via plusnet ISP. E.g on mobile internet the same results as above

Just interested to in yes/no not the actual details

[#14]

---

@kenm wrote:

i only use greenby webmail 

but daily get  " you pervert " emails in my junk folder coming from my OWN email address

Greenby says DKIM is included but is that the same as the things they tell you to do,

Whitelists or Blacklists or telling its not spam for good emails ALL OF WHICH DO NOT WORK.

I have had basic emails to hotmail and iclouud bounced back, i now have to text family members that i have emailed them to get a reply nothing their end , i then copy and paste message into my freebie AOL account and its there immediately and i dont have to sit there for ages watching it loading or refreshing on ( watching paint dry Greenby really slow )

that really is progress ?

kenm

---

This seems to be about several different things.

I assume White/Black Lists cannot work if Spam is using your own spoofed address. Flagging non Spam delivered to Greenby Spam Folder did seem to work for me - despite what others are saying. Though I didn't really have enough examples to be sure. I have subsequently lowered my Greenby Spam filter setting over the default setting of '3' (More aggressive) as I had stopped having real problems with genuine emails being misidentified as Spam.

AFAIK - The email User's Spam setting would only affect what happens to received emails suspected as being Spam. i.e. Being put in the user's Spam folder. It won't itself stop Spam coming into the Greenby email hosts addressed to a user.

The mail bounced from remote recipients is another matter - but related! On the one hand people want to receive all their incoming emails to their Inbox but, on the other hand, no Spam emails. The same thing to user's on other email accounts! To guarantee receiving all your incoming mail, you'd have to accept incoming Spam. To guarantee all your emails to others are received and not bounced, they would need to accept all incoming emails including Spam emails. 🤔

So, either there is a compromise somewhere between the two extremes, or every user or SP on the Internet is 100% compliant with all the same current security standards all of the time. There may well be issues with the current  Plusnet/Greenby email setup, but I'm not knowledgeable enough to know exactly what they are or how to solve them.

Then again, it really does fall to email users to help - by keeping their email address as private as possible and certainly off public Internet sites.

[#15]

@pvmb 

With DKIM Enabled, the Greenby SMTP server sent this in the email header :

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=account.plus.com;
    s=en; t=1778250807; bh=JCRmZOigI0Tn2R32ZSrRUKVTBHmNne8UT6SrPX+caXQ=;
    h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:From:
     Sender:To:CC:Subject:Message-Id:Date:MIME-Version:Content-Type:
     Reply-To;
    b=r+4FmA8nl0fGJ4klIE1id9jtR7YQrIvHB/aFzp0ZcvY1X8YfYyvKL8vPwfgmrQeCG
     gHFR45r0GnXXk6YqMxAJYZ2jBIGh3iAz1eWSfWaNNLJAa+gpZGASR4BSsSngochu8h
     0Qp6r5hkTmBlyrVvQJT4LbNr+JJADkr7O41dWxmM=


Notice the highlighted part

s=en  the Selector  is "en"  that is the bit of text to find for the DKIM signature and
d=account.plus.com  the DNS record to lookup is : account.plus.com

This is different from an email send via Plusnet's relay.plus.net where the DKIM domain to use is d=plus.com 

There are already DNS records at the account.plus.com level they contain our SPF and MX records.

Here is an example