SPF, DKIM, and DMARC protect your domain from being used by spammers and ensure your emails are trusted by recipients.
What is SPF?
SPF (Sender Policy Framework): SPF is like a “guest list” for your email domain.
How it works: It tells receiving email servers which IP addresses are allowed to send emails on behalf of your domain.
Allowed Servers List: princejha.in specifies allowed servers (e.g., Company Mail Server, Third-Party Email Service).
Email Flow:
- Authorized Server: Email sent from an authorized server -> Email received successfully.
- Unauthorized Server: Email sent from an unauthorized server -> Email rejected.
Example: Suppose your email domain is “princejha.in”. You create an SPF record that lists which servers (like your company’s mail server, or a third-party email service) can send emails from “princejha.in”. If an email from a server is not on this list, it’s more likely to be marked as spam.
What is DKIM?
DKIM (DomainKeys Identified Mail) DKIM is like a “signature” for your emails.
How it works: It adds a digital signature to the email’s header that the recipient’s email server can verify to ensure the email hasn’t been tampered with and is actually from the domain it claims to be from.
Email Signature:
From Domain: princejha.in send an email with a DKIM signature. Verification:
- Valid Signature: The receiving server verifies the DKIM signature -> Email marked as trusted.
- Invalid/No Signature: The receiving server cannot verify the signature -> Email flagged.
Example: When you send an email from “princejha.in”, your email server adds a DKIM signature. The receiving server checks this signature against the public DKIM key published in your DNS records. If they match, the email is verified as authentic and untampered.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
What is DMARC?
DMARC is like the “rules of engagement” for email servers.
How it works: It uses SPF and DKIM to verify that an email is from a legitimate source and then tells the receiving server what to do if the email fails these checks (e.g., mark it as spam, reject it).
DMARC Policy: princejha.in sets a DMARC policy (e.g., reject, mark as spam).
Handling Failed Checks:
- Fails SPF/DKIM: Email fails SPF/DKIM checks -> Follow DMARC policy (reject or mark as spam).
- Reporting: Domain receives reports on email activities (e.g., attempted spoofing, failed checks).
Example: You set a DMARC policy for “princejha.in” that instructs receiving servers to reject any email that fails SPF and DKIM checks. It can also send you reports about how your domain is being used, so you can see if anyone is trying to spoof your email.
In short:
SPF: Only let these servers send emails for my domain.
DKIM: Sign my emails so recipients know they’re legit.
DMARC: If emails fail the SPF and DKIM checks, here’s what to do (e.g., reject them, mark them as spam).
Must read these also.
- How to Get High Quality Inbound Leads which Generate Sales?
- How You Can Achieve Maximum in Social Media Advertising?
- How to Plan Account Based Marketing Strategy?
Visual Example
1. SPF: “princejha.in” says, “Only emails from my mail server and MailChimp can use my domain.”
2. DKIM: “princejha.in” signs an email, so when it arrives, the receiver can check and say, “Yes, this is truly from ‘princejha.in’.”
3. DMARC: If an email from “princejha.in” fails the SPF or DKIM checks, the receiving server follows the rules set by “princejha.in” and maybe rejects the email or marks it as spam.
Simple Analogy
SPF: A bouncer at a club with a guest list. Only people on the list (authorized servers) are let in.
DKIM: A seal on a letter. If the seal is intact, you know it hasn’t been tampered with.
DMARC: The club’s policy for handling troublemakers. If someone not on the list tries to get in, they’re thrown out (email rejected) or watched closely (marked as spam).
Simple Steps to Setup DNS records for SPF, DKIM, and DMARC:
To ensure that your DNS records are set up correctly for SPF, DKIM, and DMARC, you can follow these steps. I’ll provide a detailed explanation of each record type along with example configurations:
SPF Record
Name: `@` (or your domain name if required by your DNS provider)
Content: v=spf1 include:_spf.google.com ~all
DKIM Record
Name: `google._domainkey`
Content: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB gKCAQEArxW7… (long string)
If your DKIM record is too long, split it into multiple strings:
“v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB”
“abcdEfGhIjkLmnopQrStuvWxYz… (remaining string) …QIDAQAB”
DMARC Record
Name: `_dmarc`
Content: v=DMARC1; p=none; rua=mailto:name@yourbusiness.com
Must read these also.
Step-by-Step Process to Add These Records
1. Access Your DNS Management Console:
Log in to the platform where you manage your domain’s DNS settings (e.g., your domain registrar, hosting provider, or DNS service like Cloudflare).
2. Add SPF Record:
Name: Enter `@` (or your domain name if required by your DNS provider).
Type: Select `TXT`.
Content: Enter `v=spf1 include:_spf.google.com ~all`.
TTL: Use the default value or set to 3600 seconds (1 hour).
3. Add DKIM Record:
Name: Enter `google._domainkey`.
Type: Select `TXT`.
Content: Enter the long DKIM key, splitting it into multiple strings if necessary.
TTL: Use the default value or set to 3600 seconds (1 hour).
4. Add DMARC Record:
- Name: Enter `_dmarc`.
- Type: Select `TXT`.
- Content: Enter `v=DMARC1; p=none; rua=mailto:name@yourbusiness.com`.
- TTL: Use the default value or set to 3600 seconds (1 hour).
Verifying Your DNS Records
1. SPF Record Verification:
Use a tool like MXToolbox’s SPF Record Lookup to verify your SPF record.
Command line: `dig +short TXT example.com` (replace `example.com` with your domain).
2. DKIM Record Verification:
Use a tool like MXToolbox’s DKIM Record Lookup to verify your DKIM record.
Command line: `dig +short TXT google._domainkey.example.com` (replace `example.com` with your domain).
3. DMARC Record Verification:
Use a tool like MXToolbox’s DMARC Record Lookup to verify your DMARC record.
Command line: `dig +short TXT _dmarc.example.com` (replace `example.com` with your domain).
By following these steps, you can ensure that your SPF, DKIM, and DMARC records are correctly configured and propagated across all nameservers, enhancing your domain’s email authentication and security.
Steps to authenticate SPF, DKIM, and DMARC for Google Workspace accounts:
1. SPF Authentication
- Locate your SPF record: In your Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email.
For reference: Enter these values on the page or form for your domain provider’s TXT records:
| Field name | Value to enter |
| Type | TXT |
| Host | @Note: If you’re adding an SPF record for a subdomain, enter the subdomain instead of @. Read Apply an SPF record to a subdomain with the Host setting for more information. |
| Value | If you only send emails from Google Workspace, enter this SPF record:v=spf1 include:_spf.google.com ~allIf you use additional email senders, enter the SPF record you created in the Basic setup or Advanced setup. |
| TTL | 1 hour or 3600 seconds |
- Add the SPF record to your DNS: Access your domain’s DNS settings and create a TXT record with the value provided by Google or mentioned above.
2. DKIM Authentication
- Generate a DKIM key: In the same section of the Admin console, click “Generate new record.”
- Publish the DKIM record: Add the generated TXT record to your DNS settings.
- Start authentication: Back in the Admin console, click “Start authentication.”
3. DMARC Authentication
Wait for SPF and DKIM: Ensure SPF and DKIM are working for at least 48 hours before setting up DMARC.
Add a DNS TXT record, or modify an existing record, by entering your record in the TXT record for _dmarc:
- TXT record name: In the first field, under the DNS Hostname, enter: _dmarc.princejha.in
Important Note: Some domain hosts automatically add the domain name after _dmarc. After you add the TXT record, you can verify the DMARC TXT record name to make sure it’s formatted correctly.
Important Note: The domain used here is an example domain. Replace princejha.in with your domain.
TXT record value: In the second field, enter the text for your DMARC record, for example:
v=DMARC1; p=none; rua=mailto:dmarc-reports@princejha.in
The field names might be different for your provider. DNS TXT record field names can vary slightly from provider to provider.
Important Note: The domain used here is an example domain. Replace solarmora.com with your domain.
Key Points to remember whilst authentication
- Order matters, so set up SPF and DKIM before DMARC.
- Allow time (up to 48 hours) for DNS changes to take effect.
- Use Google’s Toolbox (https://toolbox.googleapps.com/apps/checkmx/) or other tools to check authentication status.
- Gradual DMARC: Start with a “none” or “quarantine” policy, then move to “reject” after monitoring.
- Repeat the process for each domain you manage.
Conclusion:
Implementing SPF, DKIM, and DMARC is essential for protecting your email domain from being exploited by spammers and ensuring your emails are trusted by recipients. By configuring SPF, DKIM, and DMARC, you significantly enhance your email security posture, protect your brand’s reputation, and ensure that your emails reach their intended recipients without being marked as spam. As you set these up, remember to monitor the performance and adjust your policies as needed to strike the right balance between security and deliverability.
