SPF, DKIM and DMARC explained

Mailbox providers check every message against records published in the sender's DNS. Without them, legitimate email lands in spam and anyone can send mail that claims to be from your domain. Large providers such as Gmail and Yahoo now require these records from bulk senders.

SPF: who may send

SPF is a TXT record listing the servers allowed to send mail for your domain.

example.com.  TXT  "v=spf1 mx include:_spf.mailprovider.example ~all"

• Only one SPF record per domain; merge all senders into it.
• SPF allows at most 10 DNS lookups (include, a, mx…). Too many and the check fails.
• ~all (soft fail) is a safe start; -all is stricter.

DKIM: a signature on each message

The sending server signs each message with a private key; the public key is published in DNS under a selector.

selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq…"

Your mail platform generates the key and tells you the selector and the value to publish. Every service that sends for you (newsletter tool, CRM, store) needs its own DKIM setup.

DMARC: the policy and the reports

DMARC tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Rolling out safely

1. Publish SPF and DKIM for every service that sends mail as your domain.
2. Publish DMARC with p=none and read the reports for two to four weeks.
3. Fix any legitimate sender that fails.
4. Move to p=quarantine, then to p=reject once reports are clean.