BitFolk » Misc infrastructure

DKIM records have been published and used for rt.bitfolk.com and mailman.bitfolk.com for a long time, since most human-to-human emails sent by BitFolk use those domains.

BitFolk's transactional emails, however, such as invoices, reminders, alerts, etc. tend to come from @bitfolk.com addresses, which currently do not have a DKIM record. This should be remedied, and those emails signed.

This has become more important because there was a recent phishing attack that forged bitfolk.com email addresses. At the time there was no DKIM record on bitfolk.com, and the SPF record was an ~all (SOFTFAIL) so there was no strong automated means to tell that the emails were not genuine. The SPF record has since been tightened up to -all, though this is on the one hand not enough and on the other hand provides no way to tell if a legitimate email has simply been forwarded. A valid DKIM signature would give another way for recipients to allowlist genuine emails.