DKIM and SPF settings

[Anonymous]

Is it ok to have the DKIM setting verified and SPF configuration pending? Will this impact deliverability rate? the reason why i am asking this question is because i set up couple of domains in Marketo. While the DKIm status shows verified, SPF shows configuration pending. I tried working with the IT team but not able to fix this. I am concerned if this will impact my deliverability or is it ok?

[Anonymous]

I believe it may affect your deliverability some. We have had recent troubles with DKIM and SPF, and found without an approved SPF - most things went straight to Spam.

[SanfordWhiteman · Accepted solution]

... without an approved SPF - most things went straight to Spam.

I strongly doubt SPF was the cause because your SPF record is not consulted by the recipients of Marketo-generated emails (Marketo's SPF record for mktomail.com is used).*

On the other hand, if your DKIM setup was messed up enough that messages were signed, but failed signature verification -- that would cause rampant failures.

* Bad SPF will affect deliverability of person-to-person mail, but not Marketo-to-person mail.

[Josh_Hill13]

I agree here.

Pending just means the DNS changes haven't propagated enough for Marketo to see and verify it.

[Anonymous]

About how long would the propagation take? Our IT team completed the configuration protocol steps 2 days ago, but both DKIM and SPF statuses are Pending Configuration.

[SanfordWhiteman]

If you have only created one set of SPF and DKIM records, there is no propagation delay at all.  Propagation (not such a great term, but admittedly common) refers to the time it takes for old, cached records to be cleared out and thoroughly replaced by new records. The first time you set up an SPF record, there's no propagation delay. It's only if you then change the record that you may need to wait for a given DNS client to see the new value.

Anyway, as Neil mentioned, the Marketo auto-validator can't be trusted.  And it's not just that it doesn't understand certain valid records, it's that it doesn't catch many invalid records (also note that you only need SPF w/Marketo if you are paying for Marketo's branded sender add-on). If you tell me your domain I can tell you if the SPF record is valid or not.

[Anonymous]

Thanks for the quick reply! The domain is erectastep.com.

[SanfordWhiteman]

Yeah, the SPF record is certainly broken.

First, it's syntactically broken.  You have include:mx where the mechanism is simply mx.

Next, it's broken because it has a broken include.  include:publicastor.com will break the record because publicastor.com doesn't have an SPF record to include.

[Anonymous]

Alright - back to the IT dept. I go. Thanks!!

[Neil_Robertson6]

It depends. There are peffectly good reasons why Marketo will stay pending configuration (even with a valid SPF setup).  It will stay pending if your SPF setup uses redirects.  The Marketo SPF check is extremely primitive and does not respect redirect rules.  Our SPF for example is AOK and has been verified by both IT and Markto - yet all our domains are Pending Confiuguration.