Our new customer portal is now live!
My account
Guides

SPF, DKIM and DMARC: authenticate your email

Understand email authentication records and configure them without breaking existing sending services.

7 min · Intermediate

Updated

In this guide

Three complementary settings

SPF identifies sending services authorized to use a domain in the SMTP sender identity. DKIM adds a digital signature whose public key is published in DNS. DMARC checks alignment between the visible From domain and passing SPF or DKIM authentication, and defines handling and reporting policy.

Prepare the settings

  1. List every service sending on behalf of your domain: mailboxes, website forms, billing, newsletters and other applications.
  2. Get each service's own SPF and DKIM instructions. Use account-specific values; another domain's example record is not ready to copy.
  3. Check the existing SPF record. Publish only one TXT record containing the SPF policy at the same name. Combine the required senders into it according to provider instructions instead of adding a second SPF record.
  4. Add the DKIM public record at the selector specified by the provider and enable signing at the sending service as instructed. Never publish the private key in DNS.
  5. Introduce DMARC gradually: first verify legitimate senders and arrange report handling. A strict rejection policy can block your own messages when authentication is incomplete.

Verify actual messages

Send a test message from every sending service to an external mailbox. Inspect SPF, DKIM and DMARC results in the received message headers. The presence of DNS records alone does not establish that messages are sent correctly.

If messages reach spam

Record the bounce error code and failed authentication result. Check that DNS changes are visible and review every sending source. Authentication alone does not guarantee inbox delivery: sender reputation, recipient expectations and message content matter too.

Sources and further reading