Guide
SPF, DKIM and DMARC
These three controls help receiving systems distinguish authorized messages from impersonation. They solve different parts of the same problem.
SPF: authorized senders
SPF is a TXT policy listing systems allowed to send for a domain. Publish one SPF record at a name—not several competing records. Keep DNS-lookup limits in mind when combining providers, and use a soft policy while testing before moving to a stricter result.
DKIM: signed messages
DKIM adds a cryptographic signature to each message. The mail provider gives you a selector and DNS record. Publish the selector exactly as supplied; changing spacing or omitting part of the public key prevents validation.
DMARC: alignment and reporting
DMARC evaluates whether authenticated identifiers align with the visible From domain. Begin with reporting mode, review legitimate traffic, then gradually enforce quarantine or rejection. A strict policy deployed before inventorying senders can block wanted mail.
A safe rollout
- Inventory every legitimate sending platform.
- Publish and validate SPF and DKIM for each provider.
- Add DMARC reporting with a monitoring policy.
- Review reports and correct unknown or misaligned sources.
- Increase enforcement only after results are stable.