SPF, DKIM and DMARC, explained

SPF: who may send

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it. When a message arrives, the receiver looks up the record and checks whether the sending server is on the list.

example.com. IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"

• Each include: adds a provider's servers. End the record with -all (reject everything else) or ~all (soft fail).
• A domain can have only one SPF record. Two records make SPF fail completely.
• SPF allows at most 10 DNS lookups, counting every nested include. Go over and SPF fails for all your mail.
• SPF checks the hidden envelope sender (the Return-Path), not the From address people see. That gap is why DMARC exists.

DKIM: a signature on every message

With DKIM (DomainKeys Identified Mail), your email provider signs each outgoing message with a private key. You publish the matching public key in DNS, under a name called a selector. Receivers use it to confirm the message came from an authorised sender and was not changed on the way.

google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

• Turn DKIM on in every service that sends as your domain: your mailbox provider, newsletter tool, CRM and invoicing system.
• Use 2048-bit keys. 1024-bit keys still work but are no longer recommended.
• DKIM survives forwarding, which SPF does not. That makes it the more reliable of the two.

DMARC: the policy that ties them together

DMARC (Domain-based Message Authentication, Reporting and Conformance) checks that SPF or DKIM passed for the same domain shown in the From address. This match is called alignment. A message passes DMARC when at least one of them passes and aligns.

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

• p=none only monitors. Failing mail is still delivered.
• p=quarantine sends failing mail to spam.
• p=reject tells receivers to refuse it. This is what actually stops spoofing.
• rua= is where receivers send daily aggregate reports listing every server that sent mail as your domain. You can read them in the report analyzer.

Google and Yahoo require SPF, DKIM and DMARC from anyone sending large volumes of email to their users, and most mail providers now treat missing DMARC as a warning sign.

Rolling out DMARC without breaking email

Jumping straight to p=reject can block your own invoices and newsletters. Move in stages:

1. List every service that sends email as your domain: mailboxes, website forms, marketing tools, CRM, accounting, helpdesk.
2. Publish SPF and turn on DKIM for each of them.
3. Publish DMARC with p=none and a rua address.
4. Read the reports for two to four weeks. Fix every legitimate sender that fails, usually by enabling DKIM with your domain.
5. Move to p=quarantine. Keep watching the reports.
6. Move to p=reject once only spoofed mail is failing.

Common mistakes

Domains that never send email

Spare and parked domains are favourite targets because nobody watches them. Lock them down with two records:

example.net. IN TXT "v=spf1 -all"

_dmarc.example.net. IN TXT "v=DMARC1; p=reject"

If the domain also receives no email, a null MX record (0 .) says so explicitly.

Beyond DMARC

• MTA-STS makes other mail servers use encrypted, verified connections when delivering to you.
• TLS-RPT sends you reports when those encrypted deliveries fail.
• BIMI shows your brand logo next to your emails, once DMARC is enforced.