Email That Lands: SPF, DKIM and DMARC Without the Panic

Three records, one job

Mail you send from your own domain is judged on whether you were allowed to send it. Three records in DNS answer that question, and between them they decide whether your invoice lands in an inbox or a spam folder. Their names are worse than they are.

SPF: which servers may send for you

An SPF record is a list, published in DNS, of the servers permitted to send mail from your domain. A receiving server checks the list and sees whether the sender is on it.

The rule to keep in mind is that there can be only one SPF record per domain. Two records is a common and confusing failure: receivers see an invalid setup and give up, and your mail suffers for it. If you have more than one, they must be merged into one.

DKIM: proof the message was not altered

DKIM puts a cryptographic signature on each message. The receiving server checks the signature against a public key you publish in DNS. It proves two things: the message really came from your domain, and it arrived exactly as it was sent.

The practical benefit is that it survives forwarding, which SPF does not. A message forwarded by a reader keeps its signature, so it can still be trusted after it has travelled through someone else's mail system.

DMARC: what to do when the first two fail

DMARC is the policy that ties the other two together. It says: if a message fails SPF or DKIM, here is what you want done with it - nothing, quarantine it, or reject it. It also asks for reports, so you can see who is sending as you.

Start with the policy set to do nothing and the reports switched on. That combination is harmless and it is the whole point of starting there: you get to watch for a few weeks and find out which legitimate services send mail on your behalf - the newsletter tool, the invoicing system, the contact form - before you tell receivers to reject anything. Turning on rejection first is how a business quietly stops receiving its own invoices.

The order to do it

1. Publish one SPF record listing every service that sends for you.
2. Turn on DKIM at each of those services and publish the keys.
3. Publish a DMARC record with a policy of none and reporting on.
4. Read the reports. Add anything legitimate you missed.
5. Only then, move the policy to quarantine, and later to reject.

The habit that keeps it working

Every time you add a service that sends mail, add it to SPF and to DMARC's considerations in the same change. A record that was correct last year is the reason mail stops landing this year, and the reports are how you find out before your customers do.