SPF, DKIM and DMARC: Setup Guide for Transactional and Marketing Mail Delivery

Understanding that DMARC is the lock, while SPF and DKIM are the keys, is half the battle. Only when a recipient sees the SPF or DKIM pass, on a domain that matches the visible From:, will DMARC pass.

When DMARC passes, the mailbox provider knows the email is authentic, and is far less likely to send it straight to junk. That is if both SPF and DKIM pass too.

on the view that DMARC is the lock, while SPF and DKIM are the keys.

DMARC finally locks the door, once SPF or DKIM has opened it with the right key. Without either, you will land in junk. With both, you are golden.

It comes down to this even if you get mistakenly garbled: Along the email journey, SPF is checked by SMTP. The FROM domain in the email says what domain information belongs in the email. SPF needs to go on that FROM domain.

DKIM is checked when the email arrives. DKIM goes on the headers that come with me from my domain. DKIM signatures go on the FROM domain too, in dkim-key=domain. DKIM says I am who I say I am. It writes a signature in the email headers that say what domain claims that domain's mail.

DMARC checks the forwarded mail's domain. Once SPF or DKIM is checked, DMARC says if that domain in FROM/google.com matches the domain in FORWARDMAIL/yahoo.com or the DKIM keys. If so, the email is counted valid.

If SPF or DKIM passes and DMARC says they match, the email makes it through.

It is that simple, so long as these three pieces of the keychain are aligned. It is easy, until it is not.

Why the SPF, DKIM and DMARC records work together

These three records are a chain, but DMARC is the lock on the door. SPF and DKIM are the keys, and DMARC is the lock.

SPF is the first key, so let’s start there.

SPF first, but only one record

SPF is a rule that ensures the sender’s identity you see in the mailbox, is the true sender of the email.

SPF shows up in a DNS TXT record at yourdomain.com. This is where the first key fits in.

SPF sends the rule, which says which servers have the right to send an email on your behalf. It could be just one server, or a group. How you say it on your DNS record is:

`` v=spf1 ip4:your.IP.add.ress include:spf.yourisp.com include:list.yourprovider.com -all ``

What this means is: v=spf1 to show a SPF record;

-all to say if the sending IP does not match any SPF rule. Deny it.;

include: then each one of the control domains, each after a space; and

ip4: to say that if the sending server has an IP that matches this, it matches SPF.

The precise words, and placement are crucial – the SPF syntax is very precise.

So is the SPF limit. SPF has a strict DNS lookup limit of 10 per domain. Each include: counts, and each domain name returns in the DNS lookup PTR record. Once you hit ten, you are out.

Another SPF command, redirect= is the same. Only valid:

`` v=spf1 redirect=spf.yourdomain.com -all ``

This together is all you should publish, one time, on one SPF record. A single SPF record is required on a domain; multiple SPF records cause SPF PermError.

Let that last bit sink in – publish only one SPF record, because more than one breaks SPF.

DKIM setup and selector publishing

The DKIM record likewise publishes on your DNS. This is the second key that lets you open the door to add DKIM to your email. Publish your public DKIM key in your DNS.

You can generate DKIM keys on your email server, or your email provider will do it. Salesforce names them such as sf1 and sf2 and they use 2048-bit keys. This is a crucial fact about how you publish DNS precisely.

When you sign a message, you can see the exact selector name:

`` DKIMSignature s=2014030301; domain=service.salesforce.com; ``

If DKIM passes, its selector will name a TXT record in your DNS, like this one:

`` Selector._domainkey TXT "v=DKIM1; " The underscores matter. ``

The DKIM selector validates the DKIM signature, once a sensor verifies it.

DKIM public keys are published in DNS under the selector name, under _domainkey selectordomain.com:

`` DefaultSelector._domainkey.yourdomain.com ``

This public key is used by the IMAP server to verify a message.

DMARC policy, reporting, and the move from monitoring to enforcement

DMARC policies are managed on a separate DNS TXT record, _dmarc.yourdomain.com. Mail servers check this after SPF and DKIM.

DMARC confirms the sending domain is mail.from.mailboxes.com by aligning it with SPF or DKIM. DKIM and SPF, one or both, must pass in order for DMARC to pass.

When DKIM passes, its selector will name a TXT record in your DNS, like this one:

`` Selector _domainkey TXT "v=DKIM1; " The underscores (dashes) ``

If DKIM passes, DMARC passes, when the From domain matches the DKIM authenticated domain. Its selector validates the DKIM signature, once a sensor verifies it.

SPF checks are different, but they go in the same direction. An SPF pass would require that the SMTP envelope sender From: domain matches the From:address in your mailbox.

DMARC does the same. A DMARC pass requires that the domain in the email's From: address matches the DKIM public key selector, or the email SMTP envelope sender domain, as verified in SPF.

When DKIM passes, its selector will name a TXT record in your DNS, like this one:

`` Selector _domainkey TXT "v=DKIM1; " The underscores (dashes) ``

A DMARC pass means DKIM validated the From: domain, and SPF allowed the From: domain.

That’s what a DMARC pass means.

For DMARC to work, SPF and DKIM on the sending domain have to align with the visible From:, and with each other.

Failure to align SPF and DKIM with each other, and with the published From:, means even a DMARC none policy will fail. No DMARC pass means no From:. If the From: isn’t published, no email will be delivered.

To publish DMARC start with p=none for a monitoring-only policy. Collect aggregate reports on a daily basis, to check:

`` rua=mailto:[email protected] ``

Published as:

`` dmarc: TXT "v=DMARC1; p=none; rua=mailto:[email protected]" ``

When you read the DMARC report, you will get details of failure alignment.

Third-party senders and subdomains

Google Workspace, and Microsoft 365 have published direct acknowledgements of the DMARC failure mode of third-party ESPs on subdomains:

Google Workspace says third-party providers must match the From: address sent to mailboxes. Microsoft 365 allows subdomains, but the DKIM signature must sign the message on that subdomain. Both mandate SPF records issued on all subdomains.

Salesforce allows DKIM-signing keys to be generated, and published.

Newsletter platforms and transactional email services may mint their own SPF and DKIM keys, for use on their own domains, or on your subdomains. They have to, or else DMARC will block their messages at the mailbox.

[TO VERIFY: Which major newsletter platforms, and transactional mail services will issue SPF and DKIM keys to secure traffic on a publisher’s subdomains]

Newsletter and transactional email services munged their emails into spam for years, until DMARC was introduced, to handle this.

Contemporary email services now have SPF and DKIM adding security to what was before, a less secure environment.