SPF, DKIM and DMARC Explained

Why authentication matters

SPF, DKIM and DMARC help receiving systems assess whether email is authorised and whether the sender identity aligns with your domain. They improve authentication and can support deliverability, but do not guarantee inbox placement.

SPF

Sender Policy Framework (SPF) is a DNS record listing systems authorised to send mail for a domain. Use the value supplied by your email provider. Normally, publish only one SPF record per domain and include only legitimate sending services.

DKIM

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing messages. Receiving servers can verify it using a public key published in DNS. Your provider should supply the selector and DNS record.

DMARC

DMARC defines how receiving systems should handle messages that fail authentication and can provide reports about domain usage. It also checks alignment between the visible From domain and domains authenticated by SPF or DKIM.

Safe setup

1. Obtain exact record values from your provider.
2. Add them to the authoritative DNS zone for your domain.
3. Check that there is only one SPF record.
4. Consider starting with a monitoring policy such as p=none while identifying legitimate senders.
5. Review reports before applying a stricter policy, and update records when sending services change.

Do not copy generic values from another domain. DNS changes may take time to propagate. If legitimate messages fail, review all sending services and domain alignment before tightening DMARC.