Understand SPF, DKIM and DMARC

1. Map your senders

Authentication connects your emails with verifiable information about the domain. Start by listing the services that send for your company: your main mailbox provider, campaigns, billing and support. Identify the person who manages DNS records, the domain’s technical directory. This map makes configuration and future changes easier to coordinate. Google and Microsoft describe SPF, DKIM and DMARC as complementary mechanisms. A suitable setup covers the services your company actually uses and the sender identity that recipients see in their email application.

1. List sending services.
2. Identify the DNS owner.
3. Record the domains in use.

2. SPF: declare authorized sources

SPF declares which servers may send email for a domain used in the message’s technical envelope. Your email provider usually supplies the values to publish in DNS. Bring legitimate sources into one coherent configuration, then verify publication with the person responsible for the domain. The visible sender address and technical envelope have different roles; identifying them helps you interpret authentication results. When adding a service, revisit your sender map so the published configuration continues to reflect the way your organization sends email.

1. Obtain your provider’s values.
2. Coordinate DNS publication.
3. Verify the envelope domain.

3. DKIM: sign messages

DKIM adds a message signature using a key managed by the sending service. A public key published in DNS lets the receiving server verify that signature. Your provider supplies the selector and record type to create. After publication, enable signing through the provider’s process and send a test message. Message headers let you find the signing domain and DKIM result. Keep these details in your domain documentation so future checks, service changes and key maintenance can follow a clear process shared by the people responsible.

1. Generate the key with your provider.
2. Publish the supplied record.
3. Check a test message’s signature.

4. DMARC: connect identity and monitoring

DMARC uses SPF or DKIM together with alignment to the domain in the visible sender address. It also defines a handling policy and can request aggregate reports. These reports help identify the services using your domain. Plan deployment with your provider, verify legitimate sources and evolve the policy using observations. Complete the review with a test message and available monitoring tools. This gives the team a clear foundation for authenticating communication and maintaining the configuration as your sending services and business requirements develop.

1. Verify domain alignment.
2. Arrange report monitoring.
3. Validate the complete setup.

A little more context.