DNS setup

Overview

To be able to receive emails according to the technical agreements made in the context of NTA 7516, the DNS configuration of the receiving domain has to meet some requirements, which are described here.

NTA 7516 TXT Record

A special TXT resource record identifies your domain as NTA 7516 compliant. The record’s data also contains additional information for the sending side for validation and delivery.

Create a TXT RR with the following data:

v=NTA7516-1;startdate=<start date>;enddate=<end date>;provider=<provider>;ntamx=<priority> <mail server>;ntamx=<priority> <mail server>...

  • <startdate>: Start of the validity period as year and month (YYYY-MM) according to the NTA 7516 certification of your organization. The first day of the specified month is the first day the record takes effect.

  • <enddate>: End of the validity period as year and month (YYYY-MM) according to the NTA 7516 certification of your organization. The last day of the specified month is the last day the record takes effect.

  • <provider>: Name of the communication service. For Cryptshare for NTA 7516, use Cryptshare.

  • ntamx=<priority> <mail server>: Zero or more references to mail servers capable of receiving NTA 7516-compliant email. The preference determines the delivery-attempt order, lowest first. If no ntamx references are specified, the default MX hosts for the domain are used. For Cryptshare for NTA 7516, specify the fully qualified domain name of the Cryptshare Mail Gateway host.

Example:

myorganisation.nl. 86400 IN TXT v=NTA7516-1;startdate=2019-06;enddate=2023-07;provider=Cryptshare;ntamx=10 nta7516-mx.myorganisation.nl

In addition, adhere to these validity rules:

  • The end date must not be earlier than the start date.

  • There may be two records, for example to set up a new validity period declaration in advance, but their dates must not overlap.

  • The record must not contain a space character (ASCII 32).

  • The TTL value of each record must not exceed 86400 seconds (one day).

DANE

DNS-based Authentication of Named Entities (DANE) can be used for email transport to provide the sending party with proof of the receiving server’s authenticity. The recipient’s domain has a TLSA resource record for each mail server, containing certificate data that can be used to verify the server’s TLS certificate. DANE also requires DNSSEC.

In general, TLSA records are structured as follows:

Name: _<port>._<transport protocol>.<host>

  • <port>: Port number of the service.

  • <transport protocol>: Transport protocol used by the service, such as tcp.

  • <host>: Fully qualified domain name of the mail server.

SPF

Sender Policy Framework (SPF) is used to specify which servers are authorized to send email for a domain. Configure an SPF TXT record that includes all legitimate sending systems, including the Cryptshare Mail Gateway where applicable.

DKIM

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing messages. Publish the corresponding public key in DNS so that receiving systems can verify messages signed by the Cryptshare Mail Gateway.

DMARC

Domain-based Message Authentication, Reporting and Conformance (DMARC) builds on SPF and DKIM. Publish a DMARC TXT record for the domain to define the expected authentication policy and, if required, reporting destinations.

DNSSEC

DNS Security Extensions (DNSSEC) provide integrity and authenticity for DNS responses. DNSSEC must be enabled and correctly configured for the domain when DANE is used.