Quick answer
These three DNS records are how you prove your mail is really yours.
These three DNS records are how you prove your mail is really yours. Together they are the single biggest lever for getting past spam filters.
What you need: Control of your domain DNS and access to configure your mail server or provider.
Publish SPF
An SPF TXT record lists the servers allowed to send mail for your domain. Keep it to the senders you actually use and end with -all once you are confident.
Sign with DKIM
Generate a DKIM keypair, publish the public key as a TXT record, and configure your MTA to sign outbound mail with the private key.
Add DMARC to monitor and enforce
Start DMARC in monitor mode (p=none) and watch the reports. Tighten to quarantine or reject once legitimate mail is all authenticated.
"v=spf1 mx a ip4:203.0.113.10 -all"
"v=DKIM1; k=rsa; p=MIGfMA0G..."
"v=DMARC1; p=quarantine; rua=mailto:[email protected]"How it works, in detail
These three records answer three questions receivers ask: SPF says which servers may send for you, DKIM proves the message was not altered, and DMARC tells receivers what to do when the first two fail. SPF uses a TXT record that ends in -all once you are confident, and DKIM pairs a private signing key on the server with a public key in DNS. DMARC should start in monitor mode so you can watch reports before tightening to quarantine or reject, which prevents a misconfiguration from bouncing legitimate mail.
Common pitfalls
- Publishing p=reject before all legitimate senders pass SPF/DKIM.
- Forgetting a third-party sender in the SPF record, breaking that service's mail.
Pro tip
Use DMARC reports to find every legitimate source of mail before you tighten the policy.
Add the three records, then test with a free deliverability checker. Green across the board beats any amount of manual inbox-wrangling.
0 Comments