DNS for white label authentication with SproutDNS

I wrote last year about using “stunt” nameservers for customer subdomain authentication – i.e. dynamically generating all the authentication records needed in DNS for each customer as needed.

For example, if you’re an ESP that has customers who can’t or won’t use their own domains and you still need to give them unique subdomains you can generate CNAME records to support white label DKIM authentication:

selector._domainkey.customerid.espcustomer.com CNAME \
    selector.dkim.esp.com

or generate white label DMARC with useful rua= reporting:

_dmarc.customerid.espcustomer.com TXT \
    "v=DMARC1 p=none rua=rua+customerid@esp.com"

Once you’ve set up these DNS records once they’ll work for all your customers, you just need to put the right domains in your DKIM signature and return path.

I shared some demo code to explain the concept last year, but since then we’ve developed a robust, production-ready application to dynamically serve DNS in this way.

It’s called SproutDNS – the humble brussel sprout isn’t the flashiest vegetable, but it’s robust, tasty, easy to prepare and good for you.

The product page is at sproutdns.com and there’s documentation at docs.sproutdns.com. Take a look, and sign up for our waitlist if it’s something you’d find useful. We’ll be announcing pricing in the next few weeks, but if you’d like to deploy it before then drop us a line.

Related Posts

Cost of authentication

At the end of last year, Steve wrote a post about the different types of authentication. I thought I’d build on that and write about the costs associated with each type. While I know a lot of my readers are actually on the sending side, I’m also going to talk about the costs associated with the receiving side and a little bit about the costs for intermediaries such as CRM systems or ESPs.

Read More

Ask Laura: Can you help me understand no auth / no entry?

AskLaura_Heading3
Dear Laura,
I’m a little confused by the term “no auth / no entry”. Gmail and other major receivers seem to be moving towards requiring authentication before they’ll even consider delivery.
Does this just mean SPF and DKIM, or does this mean the much more stringent DMARC, as well?
Thanks,
No Shirt, No Shoes, No What Now?

Read More

Why is DMARC failing?

Multiple times over the last few weeks folks have posted a screenshot of Google Postmaster tools showing some percentage of mail failing DMARC. They then ask why DMARC is failing. Thanks to how DMARC was designed, they don’t need to ask anyone this, they have all the data they need to work this out themselves.

Read More