What are SPF, DKIM and DMARC, and why do you need all three?

In short: SPF answers "which servers may send for this domain", DKIM answers "did the mail change on the way", and DMARC answers "what should the receiver do if either fails". The three complement each other rather than back each other up; if one is missing, the gap the others do not close stays open and your mail may land in spam.

What is SPF?

SPF is a TXT record in your domain's DNS that lists the servers allowed to send mail for that domain. When a receiving server gets a message, it looks at the address of the sending server and checks whether it is on the list. If it is not, it may treat the message as suspicious.

SPF has a weakness: when mail is forwarded to another address, the sending server changes and the SPF check can fail even though your mail is legitimate. Also, a domain can have only one SPF record; a second record invalidates both.

What is DKIM?

DKIM adds a signature to every outgoing message using the server's private key. The receiver verifies that signature with the public key in the domain's DNS. If the signature is valid, the message was not changed on the way and really came from this domain's server.

Because the signature is attached to the message itself, it usually survives forwarding. But DKIM alone does not tell the receiver what to do when a signature cannot be verified.

What is DMARC?

DMARC tells the receiving server what to do when SPF or DKIM fails: ignore it, send it to spam, or reject it. It can also ask for an aggregate report to be sent to the domain owner. Without that instruction, a message that fails SPF and DKIM can still land in the inbox.

How do the three work together?

| | SPF | DKIM | DMARC | |---|---|---|---| | Question it answers | Which server may send? | Did the mail change? | What to do on failure? | | Record type | TXT (domain root) | TXT (dkim._domainkey) | TXT (_dmarc) | | When forwarded | Can break | Usually survives | Combines both results | | Enough on its own? | No | No | No, it relies on the other two |

DMARC wants at least one of SPF and DKIM to pass in alignment with your domain. So setting up both means that if one falls, the other can save you.

How do I set these up on my own domain?

In MAILKODO Business the panel gives you the values for these records; you do not write them by hand. The order is:

1. Add your domain and write the ownership TXT record.
2. Enter the MX, SPF and DKIM records the panel gives you into DNS.
3. Press the check button; when all three records are seen, the domain becomes active.
4. Add DMARC with the value v=DMARC1; p=quarantine.

For a step-by-step walkthrough, see How to set up business email on your own domain.

Which DMARC policy should I choose?

There are three policies: none does nothing and only asks for reports; quarantine sends failing mail to a suspicious folder; reject refuses it outright. For a new setup quarantine is a sensible start. Once you are sure your mail passes cleanly, you can move to reject. Starting with reject straight away risks having legitimate mail refused because of a single record mistake.

Common mistakes

• Two SPF records: Merge them into one.
• +all instead of -all in SPF: +all allows everyone and makes SPF meaningless.
• Shortening the DKIM key by hand: Copy the value as it is.
• Setting up only SPF: You will fail on forwarded mail; set up DKIM too.
• Forgetting subdomains: If you will send from another subdomain, it needs records too.

Do shared @mailkodo.com addresses need any of this?

No. For @mailkodo.com addresses MAILKODO manages these records and you do not touch DNS. They become your responsibility only when you connect your own domain.

How do I know my records are right?

After adding the records, send yourself a message from another address of yours and look at the raw headers of the received mail. You should see pass for SPF, DKIM and DMARC. If you see fail or none, check the relevant record again. Remember that DNS changes do not spread at once; after fixing a record, wait a few minutes and try again. The check button in the MAILKODO Business panel reads the MX, SPF and DKIM records for you and shows which one is missing.

What if I want DMARC reports?

The DMARC value the MAILKODO Business panel suggests (v=DMARC1; p=quarantine) does not contain a report address. If you want reports, you can add a rua (report address) tag to the record yourself. Reports are raw data and hard to read; still, a look in the first months shows whether another service is sending on your domain's behalf.

Ready? Connect your own domain with MAILKODO Business.