SPF, DKIM and DMARC, explained without the jargon
If you send email from your own domain, three DNS records determine whether receiving servers trust it. They are not difficult, but they are usually explained in the language of the specification rather than in terms of what they assert.
SPF says who may send
SPF is a list, published in DNS, of the servers permitted to send email using your domain. A receiving server looks at where the message came from, checks it against your list, and treats a message from anywhere else with suspicion.
The common mistake is having more than one SPF record. The specification allows exactly one, and a second does not add to the first — it invalidates both. If you add a new sending service, its entry is merged into the existing record rather than published alongside it.
DKIM proves it was not altered
DKIM adds a cryptographic signature to each message. Your sending service holds a private key; the matching public key is published in your DNS. A receiving server verifies the signature and knows both that the message came from something holding your key and that its content was not modified in transit.
SPF and DKIM answer different questions. SPF is about the connection, DKIM is about the message. Forwarding a message breaks SPF and leaves DKIM intact, which is exactly why both exist.
DMARC says what to do when they fail
DMARC ties the two together and publishes your instruction: if a message claiming to be from this domain fails these checks, do nothing, quarantine it, or reject it outright. It also asks receiving servers to send you reports on what they saw.
Start at `p=none` and read the reports for a few weeks. They will show you sending sources you had forgotten about — an invoicing tool, a CRM, a form handler. Move to `quarantine` and then `reject` only once every legitimate source is passing, because the point of DMARC is that receivers obey it.
The order to do it in
SPF first, because it is one record and it is quick. DKIM next, from your sending provider’s control panel. DMARC last, at `p=none`, and left there until the reports are clean.
Doing it in the other order is the classic way to stop your own invoices from arriving. DMARC at `p=reject` on a domain whose SPF is incomplete will do precisely what you asked it to.
From ₹9,999 a month, including the data costs.
Start a free trial