SPF, DKIM, and DMARC are how the internet decides whether mail claiming to be from your domain is actually from you. They are DNS records, not inbox settings. Once they are published and aligned, mailbox providers have a reason to trust your From address.
If you skip them, even honest mail looks like spoofing. If you publish them incorrectly, you can block your own senders.
SPF: who may send
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send mail for your domain. A receiving server looks at the envelope sender, fetches your SPF record, and checks whether the connecting IP is authorized.
Keep the record short. SPF stops looking after 10 DNS lookups, and includes such as include: count toward that limit. Publish one SPF record, not several. Use ~all while you are inventorying senders, then move to -all when the list is complete.
DKIM: the message was not altered
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the message. You publish the public key in DNS under a selector, such as s1._domainkey.example.com. The receiving server verifies the signature against that key.
DKIM survives forwarding better than SPF, because it signs the content rather than the sending IP. Rotate selectors when you change providers. Never put the private key in a public repo or a frontend bundle.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM to the visible From domain (alignment) and tells receivers what to do on failure: none (monitor), quarantine, or reject. It also asks them to send you reports.
Start with p=none and a reporting address so you can see who is sending as you. Move to quarantine, then reject, only after legitimate mail is aligned. A reject policy with a missing DKIM key will drop your own invoices.
Alignment, in one paragraph
SPF can pass on a subdomain used only for bouncing, while the From header still says [email protected]. DMARC does not count that as a pass unless the domains align. DKIM alignment is usually the cleaner path: sign with a key on the same organizational domain as the From address.
A practical order of work
- List every system that sends as you: the product API, billing, support, CRM, and the office mailboxes.
- Publish SPF that names those senders. Check the 10-lookup limit.
- Enable DKIM for each sender and confirm signatures land on production mail, not only test messages.
- Add DMARC at
p=nonewith reporting. Read a week of reports. - Tighten to quarantine, then reject. Then add BIMI if you want a brand mark in supporting inboxes.
ArawaMail walks the mail records before a domain goes live, and the free SPF, DKIM, and DMARC checkers are there when you want a second look. When DMARC is enforced, use the BIMI checker before you publish a logo. For the product side of this story, read what transactional email is.