Setting up SPF, DKIM and DMARC

These three records decide whether your email lands in the inbox and whether others can spoof your domain.

SPF: who may send

One TXT record on the domain itself listing every service that sends as you:

v=spf1 include:_spf.provider.com include:mailgun.org -all

• Only one SPF record per domain. Merge services into a single line.
• Stay under 10 DNS lookups (each include counts).
• End with -all (reject others) once you're confident, or ~all while testing.

DKIM: a signature on each message

Your provider generates a key pair and gives you a record such as selector1._domainkey with the public key. Publish it exactly; the provider signs outgoing mail with the private key.

DMARC: the policy

_dmarc.yourcompany.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com"

Start with p=none to only collect reports. When legitimate senders all pass, move to p=quarantine, then p=reject.