Yahoo DomainKeys: Configuration Pitfalls, Tips, and Comments

Corey Pudhorodsky

I've helped a number of people configure their DNS records to support Yahoo Domain Keys over the past several weeks. There are a couple of tips that I'd like to share with the community that I'll post in this thread. I would love to hear any other feedback or comments about the instructions or DNS host requirements and configuration that you had to apply to add the TXT record.

One of the most common points of confusion is that the customer center instruction list the entire TXT record in a single string:

convio1._domainkey 86400 IN TXT "t=y; k=rsa; p=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKKtPPXbNdvhPWGVXoEShvMYnnHYpUqIo7umzoFTCYynqq9j7WpiTOHqabxteN4igg8ztEZoB6z69JPD5OSN0CAwEAAQ=="

Yet many DNS hosts provide a console or form to submit and edit DNS zone files. If this is the case for your DNS host, a breakdown of the values above is:

Hostname = "convio1._domainkey"

Note that the "convio1" above is actually the selector for the domainkey. If you or another MTA (Mail Transfer Agent) is using DomainKeys on your behalf, you may have multiple TXT records with different selectors.

Also note, that your domain name will be appended to the end of this hostname value. In most cases it seems that DNS host do this for you but I've seen a case or two where you actually have to add the domain name. For ahs.org this would be: "convio1._domainkey.ahs.org"

TTL (Time To Live) = 86400

The above value is 24 hours (in seconds). Some forms may do the math for you and present the options in hours or days.

Value = "t=y; k=rsa; p=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKKtPPXbNdvhPWGVXoEShvMYnnHYpUqIo7umzoFTCYynqq9j7WpiTOHqabxteN4igg8ztEZoB6z69JPD5OSN0CAwEAAQ=="

It is extremely important that this value has no extra characters or line breaks in it. Not that the quotes above are used just to separate the text, you don't need to include this in the text box that is presented.

The names of the fields may vary from what is listed above, but I hope this breakdown helps.

Corey Pudhorodsky

I wanted to share another tip that some might find helpful: Recently we were working with another client who was having problems getting the Yahoo DomainKey added with their DNS host. The online form that the host provided places to input: Domain, TTL, Record Type, and Value. All of the information seemed to be entered correctly, but the answer section of the Convio DNS checking tool returned:

;; ANSWER SECTION:

convio1._domainkey.ahs.org. 14400 IN TXT "t=y"

In this case, the DNS host: "HostGator," needed to insert the text by special request instead of through the standard interface to avoid truncating. This may be the case with other DNS hosts as well.

Corey Pudhorodsky

Thought I'd post another tip that I've heard a couple of people run into when setting up the txt records. In this case, the tip applies to configuring the TXT record for the Sender Policy Framework (SPF). The instructions on the customer site refer to an @ symbol in the record. This basically a shortcut or reference to the domain name that the record is being added to. It points to the domain for that record. If a DNS host does not support using an @ symbol in the host name, generally the name of your domain can be used.

Ethan Waller 2

I running into an issues... I was able to updated the SPF records and did the DNS checker got two green check marks. However now some users for example @MAC.com and @ATT.net email accounts are not able to email the domain. When they do they xyz changes to a @rfctu-live.convio.net. This is the CNAME address that convio uses for webhosting... When I took out the new SPF records everything went back to normal?

Any ideas?

Ethan

Heather McDowell

>

Corey Pudhorodsky

Heather McDowell:

>

This is generally the purpose of Yahoo DomainKeys and SenderID - to allow a message to get tied back to a domain and have it be verified as being from someone who owns that domain regardless of where the message is being sent from.  It doesn't really matter what server or IP address the message is coming from.  The two technologies work differently.  An (over)simplified explaination of the two are:

- SenderID - The domains aliases or IP addresses that have permission to send are included in a txt record on the DNS host.  When an email server receives a message it checks the SenderID record to find out if the message is from one of those sources.

- DomainKeys - When messages are sent, a digital signature is included in the message.  This "signature" needs to match a corresponding value that is placed on in a DNS text record.