On the SPF part of that new DMARC thing...

Jeremy Reynolds

With the upcoming/more aggressive DMARC requirements from google/yahoo, I'd like to check something. As far as I can tell, Luminate was built in such a way that it'll always fail half the equation, right?

Check this out in the email resource center:

“As an email service provider (ESP), the return-path in Blackbaud’s email header for bounces allows SPF to pass, but not align…For this reason, you must DKIM sign your sending domains with us…to successfully implement DMARC.”

The tech here is a little bit confusing, because SPF is actually two different things:

• SPF Alignment: Checks if the “from” header matches the “return path” header.
  • If this fails, someone was sending the email on your behalf.
• SPF Authorization: Checks if the computer that sent the message is actually owned by the sender.
  • If this fails, the email came from a computer you haven't said you own.

Here's the key, DMARC only cares about the first one, alignment. If you look at the source code when you get an email from LO, you'll see SPF “pass” in there a couple of times. But that's the second check, not the first one.

And that's what the quote above is saying, SPF (authorization) passes, but sender policy (alignment) doesn't. Or to paraphrase the article, “LO is configured to always fail half the DMARC test. Make sure DKIM passes or you're going to have a bad time.”

Jeremy Reynolds

Now. You might be asking yourself, “Does this really matter? Half the DMARC check fails, but as long as the other one works, we'll pass and everything's okay, right?"

Yes, assuming there's never a hiccup with the DKIM authorization. And assuming gmail or yahoo aren't secretly giving preference to those who fully pass DMARC instead of only half of it. Or they don't decide later to want both DMARC tests to pass.

You also might be asking, “Isn't this what happens for any vendor out there who sends email on my behalf?”

In my experience, BlackBaud is the only vendor who does it this way. In the same way that Luminate websites are usually something like donate.mycharitydomain.org, it should be possible for BB's email servers to do something similar. That's what all the other email vendors our org uses do.

Soo…anyone know if it's on the roadmap to get Luminate to start using our domains for email “return path” instead of the old convio ones?