SPF, DKIM and DMARC: An Email Authentication Guide
The three building blocks that prevent emails sent from your domain from being spoofed: SPF, DKIM and DMARC.
Why are they needed?
The email protocol (SMTP) was not designed for authentication, so the sender address can easily be spoofed. SPF, DKIM and DMARC work together to protect your domain's reputation and deliverability.
SPF
SPF is a TXT record that defines which servers may send email on your behalf. The receiving server checks whether the sending IP address is on this list. An SPF record should not require more than 10 DNS lookups.
DKIM
DKIM adds a digital signature to every message. The receiving side verifies the signature with the public key in your domain, proving the message was not altered in transit. The selector name makes it possible to locate the relevant key record.
DMARC
DMARC says what to do based on the SPF and DKIM results. It defines the policy (none / quarantine / reject), reporting addresses and alignment rules. It is recommended to start monitoring with p=none and move to a strict policy after reviewing the data.
Order of implementation
- Make your SPF record correct and within the limits.
- Enable DKIM on all of your sending sources.
- Publish DMARC with a monitoring policy.
- Review reports regularly and tighten the policy.
Auditing with NetQuery
The Email Security tool analyses your SPF chain, DKIM selectors, DMARC policy and the blocklist status of your MX servers in a single pass.