The Cloudflare wizard is very simple, and the wizard is asking you a couple of questions in order to generate the desired record based on the options you select / input you provide, and once done, you can hit a Submit button and it’ll automatically add the final record for you.
There are however a couple of things I’d like to change with them, if I had the option to do so.
Anyway, since you did explicitly say “to avoid spoofing”, - do you actually have any desired policy in mind?
- Anyone trying to claim they are my domain should get immolated (e.g. rejected and never presented to the final recipient, e.g. similar to how a letter would be returned to sender if the destination address is invalid).
→ DMARC with a p=reject (eventually explicitly set sp=reject), and a SPF ending in “-all”.
- Anyone trying to claim they are my domain should get the message delivered, but just go to spam.
→ DMARC with a p=quarantine (most often sp=quarantine / sp=reject), and a SPF ending in “-all”.
- … BUT, my provider is NOT DKIM signing my messages with a valid author signature matching my From: header.
→ DMARC (if added) should NOT be anything else than p=none. SPF still ending in “-all”.
But DMARC and SPF aren’t the only two things we should be looking at.
- Are you only sending messages through Strato?
-
-
- → Add a TXT record, with this information:
Type: TXT
Name: @
Content: v=spf1 include:_spf.strato.com -all
TTL: Preferably set it to something like 12-24 hours, as mail related records likely do not change that often.
-
-
- → We would need to figure out what other providers you are using, so we can eventually include them too, if they are really necessary for your SPF record.
A lot of people out there misunderstand things such as SPF and DMARC.
According to the list above, and especially #3, I would suggest that you first look in to whether Strato (or any other provider you may use, if you also use other ones) is actually properly DKIM signing your messages, before adding any DMARC record.
Stuff like that can be tested with a couple of online “email testers” you can find Googling around, but the quality will vary (a lot) from site to site.
If you are open minded to sending emails away to third parties in order to test and determine, one destination you can try would be:
→ [email protected]
Within some seconds to a couple of minutes, you will receive a message back, and let’s assume that you sent the message from an email address called “[email protected]”, then you would be looking for something like this:
==========================================================
Summary of Results
==========================================================
SPF check: pass
DKIM check: pass
SpamAssassin check: ham
----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result: pass
ID(s) verified: [email protected]
----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result: pass (matches From: [email protected])
ID(s) verified: header.d=example.com
----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.4.0 (2014-02-07)
Result: ham (-2.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
[...]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
As you see all the data here is a match, e.g. in SPF we got [email protected], in DKIM we got both pass (matches From: [email protected]), and header.d=example.com, it literally all matches your From: address and there is proper alignment due to “@example.com” / “d=example.com” being identical (and passing).
If you see all this, I would say you are ready to add a DMARC record like the one I explained in #1 above, and together with the SPF record mentioned above, I’d would then say:
Add a TXT record, with this information:
Type: TXT
Name: _dmarc
Content: "v=DMARC1; p=reject; sp=reject;
TTL: Preferably set it to something like 12-24 hours, as mail related records likely do not change that often.
However, if you have 10 different providers sending mail on your behalf, you would have to conduct some testing like the above through all of your 10 different providers, and verify first.
NOTE → If just 1 of the 10 different providers is not doing exactly as expected, and you are adding that DMARC p=reject/sp=reject record, messages through that one provider will likely be rejected and returned to it’s sender, as mentioned in #1 above.
DMARC also allows for reporting (rua/ruf tags), the many of the larger ones like Google, Yahoo and so are sending aggregated (statistical like) reports to the rua tag, however, the majority of the larger ones ignore the ruf tag, that would otherwise send one single report per message failing authentication
The rua reports (and of course, also the limited ruf ones) can be used to determine whether you are ready to jump from various levels (none → quarantine → reject), if you’re worried about that.
But if you already know enough about your infrastructure / set up (e.g. like the “Are you only sending messages through Strato?” question above), that will definitely help a lot to determine what you are ready to do, or go for, right now.
What you can and can’t do right now, will always depend on the various variables available, and if any of those variables are actually changing, even just slightly, it can mean a lot.
