SPF, DKIM, and DMARC: setup that actually sticks
Resumen: SPF, DKIM, and DMARC answer different questions. SPF lists which servers may send mail for your domain. DKIM proves a message was not tampered with in transit. DMARC tells receivers what to do when those checks fail and where to send forensic reports.
Three proofs, one goal
SPF, DKIM, and DMARC answer different questions. SPF lists which servers may send mail for your domain. DKIM proves a message was not tampered with in transit. DMARC tells receivers what to do when those checks fail and where to send forensic reports.
Mailbox providers treat all three as part of modern bulk sending hygiene. Gmail and Yahoo explicitly require authenticated mail with aligned From domains for senders above their volume thresholds. Missing any leg of the tripod invites spam foldering or outright rejection.
Your ESP publishes most of the technical values. Your job is DNS access, patience for TTL propagation, and reading aggregate reports without panicking at the first unknown sender.
SPF without ten lookups
SPF lives in a TXT record at the root or designated subdomain. Each include mechanism counts toward the ten DNS lookup limit. Stacks that chain Google Workspace, Salesforce, Zendesk, and an ESP quickly break SPF until you flatten includes or move some sends to subdomains.
A workable pattern for startups: marketing mail from mail.example.com, transactional from notify.example.com, corporate mail still on Google. Each subdomain gets its own SPF record tailored to the tools that actually send from it.
SPF alone is insufficient because forwarded mail breaks SPF alignment. That is why DKIM matters: it survives forwarding when SPF does not.
DKIM signing and key hygiene
DKIM uses a public-private key pair. Your ESP signs outgoing messages with a private key; you publish the public key in DNS. Rotate keys when vendors recommend it and when staff with DNS access leave the company.
Use at least 1024-bit keys; 2048-bit is better when your DNS provider allows the longer TXT chunking. Multiple selectors can coexist during rotation so you do not invalidate in-flight mail.
Alignment means the d= domain in the DKIM signature should match the domain in the From header for DMARC to pass via DKIM. Many teams pass DMARC through DKIM even when SPF fails on forwards.
DMARC rollout that will not break payroll
Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100. Monitor aggregate reports for thirty days. Identify legitimate senders still failing alignment: old newsletter tools, ticket systems, calendar invites.
Move to p=quarantine on a subset using pct=25, then pct=100 once failures are near zero. Only then consider p=reject for domains that never send human mail from employee inboxes.
Reject policies on the primary corporate domain without inventorying every SaaS sender is how payroll receipts start bouncing. Subdomains for marketing and product mail isolate that risk.
Verification checklist
After publishing records, use your ESP's verifier, dig from a terminal, and third-party checkers. Send test mail to Gmail and inspect Authentication-Results headers for spf=pass, dkim=pass, and dmarc=pass.
Document every authorized sender in an internal wiki: ESP, support desk, billing, HR tools. Deliverability audits fail when marketing fixes DNS while support still sends from an unauthenticated legacy app.
Re-check authentication after any domain migration, ESP change, or acquisition of a new sending product. DNS drift is slow and silent until complaints spike.
SPF lives in a TXT record at the root or designated subdomain. Each include mechanism counts toward the ten DNS lookup limit. Stacks that chain Google Workspace, Salesforce, Zendesk, and an ESP quickly break SPF until you flatten includes or move some sends to subdomains.Fuentes
Preguntas frecuentes
Can I use one DKIM key for every tool?
Each sending service should use its own selector unless the vendor explicitly supports a shared setup. Mixing keys makes rotation and troubleshooting harder.
How long until DNS changes propagate?
Often minutes to hours, but plan up to forty-eight hours for global propagation when you cut over production sends.
Does DMARC p=reject improve inbox placement?
It protects your domain from spoofing and can indirectly help reputation, but placement still depends on engagement and content. Authentication gets you considered, not guaranteed.