Setting up a mailserver is a horrible experience in itself, but I like challenges.

DKIM in particular is so insanely bad though that I'm contemplating joining BigTech in their crusade against e-mail.

@stevelord My problem I think is with the fundamentals. Suppose you are a tech enthusiast who wants to use this mode of auth. Now you have to:
- Learn that your keys won't fit into DNS records
- Learn that while you can split your key to multiple records, there is no guarantee the client will concat them in a particular order
- Learn that while you can fall back to shorter key sizes they may be insecure or require an algorithm that either your tool or the receivers doesn't support

While you test all this, you also have to consider caching of course.

Did I miss anything?

@stevelord Oh yes that's also a fun trick to debug!

@buherator So far swiss provider protonmail, german providers Tutanota and mailbox.org appear to get this task done in a manner that passes due diligence every time I run it. Running my own mailserver and installing patches / checking logs on sunday mornings ? Thanks but no thanks.

@ping4pong My goal is to learn, but I agree ignorance is sometimes a bliss :)

@buherator @stevelord also, if you use Spamhaus ZEN for dnsbl then remember to use a local caching resolver such as unbound as requests via open DNS like quad9 are rejected.

@buherator @stevelord if you want help, ask. My street creds are summarised by “running his own mail server since UUCP and other people’s on request.”

@buherator @stevelord Also, if you implement “BIMI”¹ so that your “brand indicator” appears next to email in certain webmail services then remember the image can be anything you want ²

__
¹ https://en.wikipedia.org/wiki/Brand_Indicators_for_Message_Identification
² there are domains known to have goatse…

@cynicalsecurity @stevelord Thanks, I'm pretty sure I could handle this, but also that I don't want to: as I understand DNS makes signature evaluation non-deterministic and according to some test services having a failed DKIM check results in worse scores than no DKIM, so it's better not to configure it in the first place...

Re: BIMI I hope I can sit out the time it dies as it should...

@stevelord yes, isn't it sooo tempting? @buherator

@stevelord not that I might have BIMI enabled on several of my domains, nooo…. 😇​ @buherator