SPF, DKIM, and DMARC: a practical guide

SPF

SPF is a TXT record that lists which servers are allowed to send mail for your domain. Receivers use it to check whether the sending IP is authorized.

DKIM

DKIM signs outgoing messages. The public key lives in DNS, and receivers verify the signature to ensure the message wasn't altered and is associated with your domain.

DMARC

DMARC tells receivers what to do when SPF/DKIM checks fail and can provide reporting. It's the policy layer that helps you reduce spoofing.

Common mistakes

• Publishing multiple SPF records instead of a single consolidated one.
• Forgetting to update SPF when you add a new outbound sender.
• Setting an aggressive DMARC policy before monitoring reports.