Since 2024, Gmail, Yahoo and Microsoft require email authentication from senders, and strictly so for anyone sending in volume. Without SPF, DKIM and DMARC, your mail lands in spam or gets rejected, and anyone can spoof your domain. The three work together: SPF says which servers may send, DKIM signs each message, and DMARC tells receivers what to do when checks fail, and sends you reports.

SPF: who may send for your domain

SPF is one TXT record on the domain used in the envelope sender (Return-Path):

example.com.  TXT  "v=spf1 ip4:203.0.113.25 include:_spf.google.com -all"
Part Meaning
v=spf1 SPF version (required, first)
ip4: / ip6: Allowed IP addresses or ranges
a / mx The domain’s A / MX hosts are allowed
include: Also allow another domain’s SPF (your email provider, newsletter tool)
-all Everything else fails (recommended)
~all Everything else soft-fails (useful while testing)

Rules:

  • Only one SPF record per domain. Two v=spf1 records together are an error. Merge them.
  • The 10 DNS-lookup limit: include, a, mx, exists and redirect each cost lookups, and nested includes count too. Over 10 means a permanent error (permerror), and failed authentication. Remove unused services, and prefer ip4: for your own servers.
  • Every service that sends as your domain needs to be covered: your server, Google or Microsoft, transactional providers (SendGrid, Mailgun, SES), newsletter tools, CRMs.

DKIM: signing every message

The sending server signs outgoing messages with a private key, and publishes the public key in DNS under a selector:

mail2026._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

Receivers fetch the key named in the message’s DKIM-Signature header (s=mail2026; d=example.com) and verify that the message wasn’t altered.

Hosted providers (Google, Microsoft, SendGrid) generate the keys for you. You publish the TXT or CNAME records they show.

Your own Postfix server, with OpenDKIM:

sudo apt install opendkim opendkim-tools
sudo mkdir -p /etc/opendkim/keys/example.com
sudo opendkim-genkey -b 2048 -d example.com -D /etc/opendkim/keys/example.com -s mail2026 -v
sudo chown -R opendkim:opendkim /etc/opendkim/keys
cat /etc/opendkim/keys/example.com/mail2026.txt      # → publish as DNS TXT

Configure OpenDKIM’s KeyTable and SigningTable with Postfix as a milter, or use rspamd, which handles DKIM signing alongside spam filtering. See Postfix and Dovecot mail server.

Use 2048-bit keys. Long TXT values are split into multiple quoted strings by DNS panels, which is normal.

DMARC: policy and reports

DMARC is a TXT record at _dmarc.<domain>:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r"
Tag Meaning
p= Policy for failing mail: none (monitor), quarantine (spam folder), reject
rua= Where to send daily aggregate reports
pct= Apply the policy to a percentage of mail (for gradual rollout)
adkim / aspf Alignment strictness: r relaxed (default), s strict
sp= Policy for subdomains

Alignment is the key DMARC concept. A message passes DMARC if SPF or DKIM passes and the passing domain aligns with the visible From: domain. A newsletter tool that signs with its own domain passes DKIM, but fails DMARC for your domain until you set up DKIM for your domain in that tool.

Safe rollout

  1. Publish p=none with rua reporting. Collect reports for 2–4 weeks.
  2. Read the reports (a DMARC report analyser makes the XML readable). Find every legitimate source that fails, and fix its SPF or DKIM.
  3. Move to p=quarantine, optionally with pct=25, then 100.
  4. Finally p=reject, which gives full spoofing protection.

Gmail and Yahoo require at least p=none from bulk senders. Stronger policies protect your brand from phishing.

Test everything

Send a message to a Gmail account, open it, and choose Show original. You should see SPF: PASS, DKIM: PASS and DMARC: PASS.

From the command line:

dig +short example.com TXT | grep spf1
dig +short mail2026._domainkey.example.com TXT
dig +short _dmarc.example.com TXT

Services like mail-tester.com score a test message, and also check reverse DNS and blocklists. See PTR records.

Beyond the big three

  • PTR / reverse DNS for your sending IP, matching the HELO hostname. This is essential for self-hosted mail.
  • MTA-STS and TLS-RPT to enforce TLS for incoming mail. See SMTP security.
  • BIMI to show your logo in some inboxes. It requires DMARC enforcement (and often a certificate).

Quick reference

Record Location Example
SPF example.com TXT v=spf1 ip4:203.0.113.25 include:_spf.google.com -all
DKIM selector._domainkey.example.com TXT v=DKIM1; k=rsa; p=…
DMARC _dmarc.example.com TXT v=DMARC1; p=none; rua=mailto:…

Related: MX records and email deliverability.

  • Email
  • DNS
  • Security