Set up SPF, DKIM and DMARC

The three records that decide whether your mail reaches the inbox or the spam folder.

These records let receiving servers verify that mail claiming to be from your domain really is. Without them, legitimate mail lands in spam and anyone can forge your address.

SPF — who may send

One TXT record at the root of the domain, listing every service allowed to send as you.

example.com.  TXT  "v=spf1 include:_spf.google.com include:spf.webvuecloud.com ~all"

DKIM — a signature on every message

The provider generates a key pair and gives you a public key to publish as a TXT record on a selector hostname. Mail is then signed on the way out and verified on arrival.

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

DMARC — what to do with failures

DMARC ties the two together and tells receivers what to do when a message fails both. Start in monitoring mode, read the reports, then tighten.

# week 1 — watch only
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

# once reports are clean — quarantine
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com"

# final state
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Check your work

dig example.com TXT +short
dig google._domainkey.example.com TXT +short
dig _dmarc.example.com TXT +short