SPF, DKIM, and DMARC what are they?

Simply put they are DNS records of type TXT. If it’s your first time hearing those, it’s probably because Gmail began requiring them.

In Grog Terms:

SPF – Who can send your mail?

This TXT record lists the IPs or domains allowed to send email on your behalf. Setting it up is the easy part: go to your DNS provider and add a TXT record like this one:

mysite.com. IN TXT "v=spf1 include:_spf.google.com include:_spf.microsoft.com ip4:203.0.113.0/24 -all"

Breaking it down:

1. v=spf1 – SPF version
2. include: / ip4: – allowed domains and IPs
3. -all / ~all – hard vs soft fail, “block it” vs “maybe block it”. Either way it’s only a suggestion: the receiver gets the final say.

DKIM – Was it really you?

Your mail server signs every outgoing email with a private key (the same key-pair idea SSH uses). The matching public key sits in your DNS, so the receiver can check the signature and know two things: the mail was signed by someone holding your domain’s key, and nobody changed it on the way.

Nothing gets encrypted, though. Anyone along the way can still read the email. It’s a wax seal, not a locked box.

Setting it up:

1. In your email manager (SMTP client, DirectAdmin, cPanel) create a DKIM key pair. DirectAdmin stores it in:

/etc/dkim.keys

2. In your DNS manager add a record with the public key. It should look something like this:

v=DKIM1; p=76E629F05F709EF665853333EEC3F5ADE69A2362BECE40658267AB2FC3CB6CBE

DMARC – What to do with rejects?

It builds on the other two: your policy for mail that fails the checks (reject it, quarantine it, or let it through anyway), plus a free monitoring feed. Typical DMARC looks like this:

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; ruf=mailto:forensics@example.com; pct=100; sp=reject"

It tells the receiver to send data about rejected emails to forensics (contents and data) and send statistics to reports (x mails were sent from x.x.x.x IP).

So, in one breath

SPF says who’s allowed to send. DKIM proves the mail is yours and untouched. DMARC tells the receiver what to do when those checks fail, and where to send the report. Set up all three and your mail stands a much better chance of not landing in spam next to the Nigerian princes.

Got records already and not sure what they say? Paste them into the SPF & DMARC builder: it reads them back in plain words and flags the usual mistakes, or builds new ones from a few choices.

Cover: Gabriel Metsu, Man Writing a Letter and Woman Reading a Letter, c. 1664–66, National Gallery of Ireland, public domain.