SPF, DKIM and DMARC on one page
| Record | Where it lives | Looks like |
|---|---|---|
| SPF | a TXT record on your domain | v=spf1 include:_spf.google.com ~all |
| DKIM | a TXT (or CNAME) record at <selector>._domainkey.<domain> |
v=DKIM1; k=rsa; p=MIIBIjAN… |
| DMARC | a TXT record at _dmarc.<domain> |
v=DMARC1; p=reject; rua=mailto:reports@example.com |
SPF
- Have exactly one SPF record. Two records break SPF entirely.
- Add an include for each service that sends as you, and remove the ones you've stopped using.
- Stay within 10 DNS lookups, counting the lookups inside each include. Past that, receivers treat the whole record as broken.
- End with
~all(soft fail) or-all(fail). Never+all, which lets anyone send.
DKIM
- Each sending service gives you its own key to publish, under its own selector.
- Use 2048-bit keys where the service offers them.
- When you stop using a service, delete its key.
DMARC
- Start with
p=noneand a report address (rua=), so you can see who sends as you before you change anything. - Move to
p=quarantine, thenp=reject, once the reports show your own mail passing. Moving to p=reject safely walks through it. sp=sets the policy for subdomains. Without it, they followp=.
Alignment
DMARC passes only when SPF or DKIM passes for the same domain people see in the From line. A service that signs as its own domain, rather than yours, passes DKIM but not DMARC. That's why services ask you to publish DKIM records on your own domain.
In healthcheck.email
The DNS & registrar tab lists every record we read. The Mail flows tab shows each sender with whether it's in SPF, signs with DKIM, and aligns.