2

Assumptions

  • CiviCRM is running on crm.example.org
  • Bounce processing is configured to use bounce.example.org
  • Mails are send from example.org, mail.example.org and example.com

Issue

If we were to enable DMARC for example.com it would fail the SPF Alignment since the domain example.com can't be aligned with bounce.example.org. We would additionally need a bounce processing for "bounce.example.org" and thus using this return path. However CiviCRM currently only supports one bounce processor. At least that is my understanding of it.

Here is a usefull illustration for this issue: https://help.zoho.com/portal/en/kb/campaigns/deliverability-guide/domain-authentication/articles/when-spf-or-dkim-alignment-fails#SPF_alignment

DKIM Alignment

Adding a DKIM signature per "From Domain" works just fine and it will pass. Either by using a relaxed or strict alignment.
works for: example.org, mail.example.org and example.com

SPF Alignment

The Return-Path Domain needs to align with the "
works for: example.org and mail.example.org
fails for: example.com

DMARC Check

Since the DKIM Alignment will work most of the time, the DMARC check would pass. But sometimes mailservers also mess with the mail content and thus make the DKIM alignment fail, resulting in a failed DMARC check and your mail not beeing delivered / ending in spam.
works for: example.org and mail.example.org
may fail for: example.com

Brainstorming Ideas

  1. Extend CiviCRM to use multiple mail accounts for bounce processing and let it chose the matching mail account according to the from domain.
    I have only found https://github.com/JMAConsulting/biz.jmaconsulting.ode that is slightly touching this issue, but does so by preventing from sending with different domains.
  2. Customize the outgoing mailserver to rewrite the return path domain to match the from domain and customize the incoming mailserver to rewrite the modified return path domain back to the original bounce processing domain.
    Can probably be done, but will be quite technical and brittle and we currently don't have control over the mailserver for incoming mails.
  3. Use the CiviCRM multisite feature: It should enable the use of multiple bounce processing accounts: Is it possible to configure CiviMail to send from two different domains?
    The overhead and technical challenges does not seem to be reasonable to me. We only need one instance of CiviCRM.

Is there something that I'm missing or that I have misunderstood? Any extension heading in the right direction?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.