SPF, DKIM and DMARC explained: email authentication

Why email authentication?

Email authentication prevents spammers from abusing your domain for phishing. Without SPF, DKIM and DMARC, criminals can send emails that appear to come from your company. Additionally, these records improve your deliverability.

SPF: Sender Policy Framework

SPF specifies which mail servers may send on behalf of your domain.

How it works

1. You publish an SPF record in DNS
2. Receiving mail server checks if sending server is in SPF record
3. If server is not authorized, mail can be rejected

SPF record example

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Explanation:

• v=spf1 - SPF version 1
• include: - trust SPF of these domains
• ~all - soft fail for unauthorized servers

Setting up SPF

1. Identify all servers that send mail (hosting, newsletter, CRM)
2. Create SPF record with all sources
3. Add as TXT record in DNS
4. Test with SPF checker tools

DKIM: DomainKeys Identified Mail

DKIM adds a digital signature to outgoing email.

How it works

1. Your mail server signs each mail with a private key
2. The public key is in your DNS
3. Recipients verify signature with public key
4. If signature matches, mail wasn't modified in transit

DKIM record example

selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGf..."

Setting up DKIM

1. Generate a DKIM keypair (usually via your mail provider)
2. Publish public key as TXT record
3. Configure mail server to sign
4. Test with DKIM validators

DMARC: Domain-based Message Authentication

DMARC combines SPF and DKIM and determines what happens on failure.

How it works

1. DMARC policy specifies action on SPF/DKIM failure
2. You receive reports about failed authentication
3. You can gradually become stricter

DMARC record example

_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Policies:

• p=none - report only, no action
• p=quarantine - move to spam
• p=reject - refuse

Setting up DMARC

1. Start with p=none to monitor
2. Analyze reports
3. Fix authentication issues
4. Increase to p=quarantine
5. Eventually to p=reject

Implementation order

1. SPF - first, simplest
2. DKIM - next, requires mail server configuration
3. DMARC - last, builds on SPF and DKIM

Common mistakes

• Multiple SPF records (only one allowed)
• Starting too strict with DMARC
• Forgetting to publish DKIM selector
• SPF too many includes (max 10 DNS lookups)

Frequently Asked Questions

How long does it take to implement this?

Implementation time varies per situation. Simple configurations can be done within an hour, more complex setups may take several hours to a day.

What are the costs?

Costs depend on your hosting provider and package. Many basic features are included for free, advanced features may incur additional costs.

Do I need technical knowledge?

You need little technical knowledge for the basics. Most hosting providers offer extensive documentation and support to help you.