Authentication: SPF, DKIM, and DMARC
SPF authorizes sending hosts, DKIM signs message content, and DMARC tells receivers what to do on failure while giving you aggregate reports. Ship all three before you scale volume. Alignment matters as much as record existence.
Lesson objectives
- Publish correct SPF and DKIM for your ESP
- Move DMARC from none to quarantine or reject with monitoring
- Explain identifier alignment in plain language
SPF: who may send for this domain
SPF is a DNS TXT record listing authorized sending IPs or includes. Keep it short. SPF has a ten-DNS-lookup limit. Too many vendors in one record breaks authentication silently.
v=spf1 include:send.example-esp.com include:_spf.google.com -allDKIM: cryptographic integrity
Your ESP signs messages with a private key. Receivers fetch the public key from a selector DNS record. Protect the private key by never hosting it yourself unless you operate your own signing infrastructure.
DMARC: policy and feedback
DMARC ties SPF and DKIM to the domain users see. Aggregate reports show who is sending as you. That includes legitimate ESPs you forgot and spoofers you need to reject.
Worked exercise: Audit one production from-domain
- Look up SPF, DKIM, and DMARC with dig or a trusted checker.
- Send yourself a message and inspect Authentication-Results.
- Confirm the visible from-domain aligns with DKIM or SPF per your DMARC policy.
End-of-lesson checklist
- SPF includes only current sending services
- DKIM keys rotated and 2048-bit where supported
- DMARC rua mailbox monitored weekly
- No leftover SPF includes from abandoned tools
Frequently asked questions
What DMARC policy should I start with?
Start with p=none to collect data, fix alignment issues, then move to quarantine and reject. Skipping monitoring is how teams lock out a forgotten ESP.
Sources
Related: Deliverability fundamentals · Best AI email tools