SPF: who may send
The Sender Policy Framework (RFC 7208) is a TXT record at your domain that starts with v=spf1. It lists the servers and services allowed to send mail using your domain in the envelope sender.
| Ending | Meaning |
|---|---|
-all | Hard fail: anything not listed should be rejected. |
~all | Soft fail: anything not listed is suspicious but may be accepted. |
?all | Neutral: no assertion. |
+all | Allows everyone. Avoid it. |
A domain may publish only one SPF record, and evaluating it may cause at most ten DNS lookups.
DKIM: a signature on every message
DomainKeys Identified Mail (RFC 6376) signs selected headers and the body. The sending system adds a DKIM-Signature header that names a selector. The receiver fetches the public key from a TXT record at selector._domainkey.yourdomain and checks the signature. Selectors let you run several keys and rotate them.
DMARC: the policy and the reports
DMARC (RFC 7489) is a TXT record at _dmarc.yourdomain. Its key tags are:
p=the policy for mail that fails:none,quarantineorreject.rua=where receivers send aggregate reports.adkim=andaspf=how strictly the domains must align.
DMARC passes when SPF or DKIM passes and the authenticated domain aligns with the visible From domain.
How they work together
| Answers | Lives at | |
|---|---|---|
| SPF | Is this server allowed to send for the domain? | TXT at the domain |
| DKIM | Was this message signed, and unchanged? | TXT at selector._domainkey |
| DMARC | What should receivers do if both fail to align? | TXT at _dmarc |
Common mistakes
- Publishing two SPF records instead of one.
- Exceeding the ten-lookup limit by chaining many includes.
- Forgetting a third-party sender such as a marketing or support platform.
- Publishing DMARC with
p=noneand never reading the reports. - Jumping to
p=rejectbefore every legitimate sender is aligned.