Email Deliverability for Associations on Virtualmin: Setting Up SPF, DKIM, DMARC, and BIMI Correctly

Why Email Deliverability is Crucial for Associations

Associations today communicate heavily via email: invitations to meetings, newsletters to members, inquiries from interested parties. But important messages repeatedly end up in the spam folder – this can lead to members not being reached and events being poorly attended. The solution: professional email authentication with SPF, DKIM, and DMARC, plus optional BIMI. In this article, we show you how to correctly set up these technologies on a Virtualmin server.

The Basics: SPF, DKIM, DMARC, and BIMI

Before we dive into practice, let's briefly clarify what's behind the abbreviations:

• SPF (Sender Policy Framework): Defines which servers are allowed to send emails for your domain.
• DKIM (DomainKeys Identified Mail): Adds a digital signature to emails that confirms authenticity.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): Determines how to handle emails that fail SPF or DKIM checks and enables reporting.
• BIMI (Brand Indicators for Message Identification): Displays the association logo in the email client if DMARC is correctly set up and a VMC certificate is present.

Together, they improve deliverability and protect against abuse of your domain.

Prerequisites on Your Virtualmin Server

Virtualmin is a powerful server management interface often used with Postfix and Dovecot for email. Ensure that:

• your server has a correct reverse DNS (PTR),
• the domain is created in Virtualmin and email services are enabled,
• you have access to DNS management (either in Virtualmin or at your domain registrar).

For the DNS records, we recommend using your hosting provider's nameservers. At Dezhost, you can manage your domains and conveniently adjust DNS settings in the customer area.

Configuring the SPF Record Correctly

An SPF record is a TXT record in your DNS. It lists all servers that are allowed to send emails for your domain. For a Virtualmin server, it could look like this:

v=spf1 mx a:mail.deinverein.de ~all

Explanation:

• v=spf1: Identifies the record as SPF.
• mx: Allows the MX servers of your domain.
• a:mail.deinverein.de: Additionally allows the IP address of the hostname mail.deinverein.de.
• ~all: All other servers are marked as "softfail" (emails are likely to be rejected, but not necessarily).

You can also use -all to strictly reject unauthorized servers. Make sure not to include too many DNS lookups (maximum 10).

Setting Up DKIM Signature

DKIM signs outgoing emails with a private key. The public key is published in DNS. In Virtualmin, you can often enable DKIM directly for each domain:

1. Go to Email Settings > DKIM.
2. Enable DKIM for the domain.
3. Virtualmin automatically generates a key pair and displays the DNS record.

The DNS record looks something like this:

default._domainkey.deinverein.de TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Copy this record into your DNS management. At Dezhost, you can add it under Domains.

Defining the DMARC Policy

DMARC tells recipients how to handle emails that fail SPF and DKIM checks. A simple DMARC record looks like this:

_dmarc.deinverein.de TXT "v=DMARC1; p=none; rua=mailto:dmarc@deinverein.de; pct=100"

• p=none: Monitor only, no action.
• rua: Address for aggregate reports.
• pct=100: Applies the policy to 100% of emails.

Start with p=none to collect reports and identify errors. Later, you can increase to p=quarantine or p=reject.

BIMI: The Association Logo in the Inbox

BIMI displays your logo next to the email – a real eye-catcher and trust signal. Prerequisite is a strong DMARC record with p=quarantine or p=reject and a VMC certificate (Verified Mark Certificate). The latter is subject to a fee and requires a trademark registration. For associations, this can be worthwhile if the brand is well-known. The BIMI record looks like this:

default._bimi.deinverein.de TXT "v=BIMI1; l=https://deinverein.de/logo.svg; a=https://deinverein.de/vmc.pem"

The logo must be in SVG format. Without VMC, you can test BIMI with some clients even without a certificate, but delivery is not guaranteed then.

Verification and Monitoring

After setup, you should test your settings. Send an email to an address like mail-tester.com and check the score. DMARC reports also provide information about authentication errors. Set up regular monitoring to detect problems early.

Conclusion: Professional Email Communication for Your Association

With correctly configured SPF, DKIM, and DMARC, plus optional BIMI, you ensure that your invitations and newsletters reliably arrive. Virtualmin provides the necessary tools, and with the right DNS records, you are well positioned. If you don't yet have a suitable hosting partner, take a look at our web hosting – ideal for associations that want to professionalize their email communication.