Forwarding/sending domain email to/via plusnet

[#1]

I've been using Google's GSuite to host my family domain's email for years. As some of you probably know, Google recently decided to drop this. They offered it back in 2006 to early adopters in order to promote their cloud venture. They were promoted as 'free forever' at the time. But I think Google's concept of lifespan is like something out of Logan's Run.

I considered forwarding my domain email to specific plusnet mailboxes and relay the outgoing domain email via plusnet's relay with appropriate spf record and dkim signing. The volume of mail is incredibly low.

Is this permitted and would it work reasonably reliably?

Thanks.

[#2]

Is this permitted and would it work reasonably reliably?

Its certainly permitted. Sending via Plusnet's relay should be fine providing you can set SPF and DKIM records for your domain. Forwarding incoming mail will depend on your domain hosting forwarding service, if it supports SRS (sender rewriting service) and you can add their forwarding servers to your doamin SPF then it ought to work. If its just the basic forwarding that many domain hosts provide for free then it probably doesnt support SRS, in which case your forwarded mail may get rejected or tageed as spam by the Plusnet servers.

Might be worth looking at a paid email hosting service, need not cost a lot , I pay ~£20/year

[#3]

SPF should be fine, however I don't believe you're goign to be able to configure DKIM whilst relaying through Plusnet's servers.

[#4]

I don't believe you're goign to be able to configure DKIM whilst relaying through Plusnet's

True, I hadn't thought that through. I'd considered that with access to DNS, the DKIM key could be configured but , of course, you're correct, the PN servers wouldn't sign the email

[#5]

Thanks for the advice and suggestions. I may well opt for some mail hosting down the line as its safer but for now:

I download our mail and store it locally. All email goes out via a local MTA, so I would be able to dkim sign it.

I have control of DNS, so can reconfigure spf, dkim and dmarc records.

In fact, if I activate the dns hoster's email forwarding, they create an spf record and to this I should be able to add plusnet (madasafish.com?).

Then AIUI, this will mean both forwarded and relayed mail's SRS requirements will be satisfied. Is that assumption correct or is there more to that aspect?

If that's in place, what if any (increased) risks are there of PN rejecting the forwarded mail?

I should have no probs with outgoing as I will have included plusnet in my spf and will set as strict a dmarc policy as feasible.

[#6]

If your email is being sent via a local MTA and not Plusnet's relay servers then there is no point in creating an SPF record for Plusnet.

[#7]

The 'local mta' is an instance of postifx with which I send outging domain mail to a smart host, currently smtp.gmail.com.

I don't bother with dkim signing mail myself ATM as GSuite is configured to do that.

I don't attempt to deliver mail directly either, as I believe home user DSL is invariably on a PBL.

So, if I relay via plusnet, I can set up a new DKIM  TXT record plus siging key on my postfix instance, sign mail and pass it to the PN relay. Will this dkim signature still be considered valid having passed through PN's relay (the extra headers added etc)?

How picky will PN servers be WRT accepting the forwarded email? Assuming SRS/SPF of my domain designates the forwarding service as legit.

Basically I am hosting a mail/groupware app but don't want to  handle mx directly.  I cannot relay the mail directly because of PBL.

[#8]

Thanks, makes sense.

---

@keeka wrote:

So, if I relay via plusnet, I can set up a new DKIM  TXT record plus siging key on my postfix instance, sign mail and pass it to the PN relay. Will this dkim signature still be considered valid having passed through PN's relay (the extra headers added etc)?

---

I make no claims to be an expert, but I'm not convinced it will be.

[#9]

I managed to test sending dkim signed domain mail via plusnet. I added the corresponding identifier & public key to a new dkim TXT record and also added PN to the spf record. Then sent an email to a gmail acount. According to gmail 'original message' headers, DKIM, SPF and DMARC all pass

It does mean sending mail I want signed via my home connection, but I'm using a VPN most of the time so that isn't too inconvenient.

Next is to see how plusnet treats email forwarded by my domain host. They (namecheap) claim to set up SRS/SPF with their forwarding feature in order that it all works 'reliably'. However, other than MX change and an SPF record, I am in the dark as far as what else they may do, or is needed, for SRS to be satisfied WRT plusnet accepting the mail. Then there's also the double spam trap. With both PN and Hosting forwarder deciding what is/is not spam. I may lose more email than is acceptable. If it don't work, I'll think again. We have until July to decide. Ones thing's for sure, it will not involve Google.

[#10]

Having read a bit more, it seems DKIM doesn't help that much as far as evading spam classification. FWICT, most anti spam engines deduct marks for invalid DKIM signature but don't boost score for presence of a valid one. Therefore, as far as spam detection goes, no DKIM sig seems as good as a valid DKIM sig and avoids risk of marking down due to invalidated signatures (possibly introduced by convoluted mail routing).

[#11]

Sorry, in the last post, it would have been more correct to say:

"many anti spam engines increase score for invalid DKIM signature but do not reduce it in the presence of a valid DKIM signature."