Business email on your domain: SPF, DKIM, DMARC
In short
SPF says which servers may send email for your domain, DKIM signs each message so it can be checked, and DMARC tells receivers what to do when a message fails those checks. Together they help your business email reach the inbox and make it harder to forge in your name.
Why these three records matter
Email was designed without a way to prove who sent a message. Anyone can write your address in the “From” line. Mailbox providers such as Gmail and Outlook therefore look for proof that a message really comes from the domain it claims. SPF, DKIM and DMARC are that proof, and they live in your DNS.
If you send business email from your own domain without them, messages are more likely to land in spam, or to be rejected.
SPF: who may send
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain. A receiving server compares the sending server with that list.
example.com. TXT "v=spf1 mx -all"This example reads: servers named in the domain's MX records may send, and everyone else should be refused. A domain may have only one SPF record. Two records make SPF fail, so merge them into one.
DKIM: a signature on each message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The sending server signs with a private key. You publish the matching public key in a TXT record, and the receiver uses it to check that the message was not altered and that your domain approved it.
selector._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=…public key…"The part before _domainkey is the selector, a name that lets you rotate keys. The mail platform generates the key pair, so you copy the record it gives you.
DMARC: what to do on failure
DMARC ties the two together. It tells receivers what to do with a message that fails both SPF and DKIM checks that line up with the visible “From” domain, and where to send reports.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:postmaster@example.com"p=none: take no action, only report. The safe starting point.p=quarantine: treat failing messages as suspicious, usually spam.p=reject: refuse failing messages.rua: an address that receives aggregate reports about who is sending as your domain.
Rolling them out safely
- Publish SPF and DKIM, and send test messages to a few outside mailboxes.
- Publish DMARC with
p=noneand read the reports for a few weeks. - Fix any legitimate sender that fails, such as a newsletter tool or a billing system.
- Move to
p=quarantine, and laterp=reject, only when the reports are clean.
How it works in INZOX Cloud
When you enable business email for a domain, the console lists the DNS records to add: the MX record, the SPF record, the DKIM record and a DMARC record, plus the records that let mail apps configure themselves. The DKIM value is created when the domain is added to the mail platform. Mailboxes can then be opened in webmail.
Questions and answers
- What are SPF, DKIM and DMARC?
- SPF lists the servers allowed to send email for your domain, DKIM signs each message so it can be verified, and DMARC tells receivers what to do when a message fails those checks.
- Can I have more than one SPF record?
- No. A domain should have exactly one SPF record. If you need several senders, merge them into a single record.
- Which DMARC policy should I start with?
- Start with p=none, which only reports. Move to quarantine and then reject once the reports show that all your legitimate mail passes.