SPF, DKIM and DMARC explained for growing organisations
Three DNS records decide whether your emails are trusted or treated as suspicious. A plain-language guide to what each one does and how they work together.
If your organisation sends email from its own domain, three DNS records strongly influence whether those messages reach the inbox: SPF, DKIM and DMARC. Major mailbox providers increasingly expect all three to be in place, particularly for organisations that send in volume.
SPF: who is allowed to send
The Sender Policy Framework is a TXT record on your domain that lists the servers and services permitted to send mail on your behalf. When a receiving server gets a message claiming to be from your domain, it can check whether the sending server is on that list.
A common mistake is publishing more than one SPF record. A domain should have exactly one, combining every legitimate sender.
DKIM: proof the message was not altered
DomainKeys Identified Mail adds a cryptographic signature to each outgoing message. The matching public key is published in your DNS. Receiving servers use it to confirm the message was sent by an authorised system and was not modified in transit.
Each email service you use, such as your mailbox provider or a transactional email platform, typically provides its own DKIM record to add.
DMARC: the policy that ties them together
Domain-based Message Authentication, Reporting and Conformance tells receiving servers what to do when a message fails SPF and DKIM alignment checks, and where to send reports about it.
A DMARC policy usually progresses through three stages:
- p=none to monitor and collect reports without affecting delivery
- p=quarantine to send failing messages to spam
- p=reject to refuse them outright
Starting with monitoring lets you discover every legitimate service sending as your domain before you begin enforcing.
Where to begin
Make an inventory of every system that sends email using your domain: your mailbox provider, website forms, newsletters, invoicing and booking tools. Then confirm each one is covered by SPF and signing with DKIM before moving DMARC towards enforcement.
If you would like help reviewing your domain configuration, our domain and hosting management service covers exactly this.
SOAS Technology Team
Editorial
Articles written and reviewed by the engineering and consulting team at SOAS Technology.