Email authentication

Treat email authentication as a chain. Build it around the systems that send as your domain, then check a received message before trusting the setup. SPF lists authorized sending servers, DKIM signs messages so tampering can be detected, and DMARC tells receiving systems how to handle mail that fails.¹ A message can pass an authentication check while DMARC still fails if the MAIL FROM and From domains do not align.² DMARC passes when at least one SPF or DKIM alignment check succeeds.³

Set the sending boundary

Start with the domains and systems that can send in the name of each domain. This inventory determines what you publish and test.

List the domains or IP addresses for every email sender before determining the SPF record.⁴ Treat each sending subdomain as its own work item because each needs an SPF record and a DKIM record for DMARC.⁵ Keep the inventory beside the DNS changes so a new sending service has a clear place in the authentication check.

Publish SPF

Use the inventory to tell receiving systems which sources may send for the domain. Check what is already published before adding or changing a record. Use an internet checking tool to see whether SPF already exists for the domain.⁶ Set up SPF by adding an SPF DNS TXT record to the domain.⁷ Receiving systems use that record to verify that messages came from authorized servers.⁸ Build the record from the domains or IP addresses in the inventory, and use -all so DMARC can act on messages that fail SPF and also lack a DKIM signature.⁹

Test every source listed in the record. If a legitimate sender is missing, its mail can fail the sender check even when the visible From address looks right.

Sign outgoing mail

SPF describes an authorized source. DKIM gives the message a signature that the receiving system can check against your domain. DKIM helps validate mail sent from your organization and helps prevent spoofed senders used in phishing attacks.¹⁰ Generate a public DKIM key and add it to the domain.¹¹ All mail from the sender should be DKIM signed.¹² Publish the public key in the domain's DKIM DNS record so destination systems can verify the message signature.¹³

Send a representative message from each system that uses the domain and check the receiving message headers. Services use different header formats, though a working DKIM result should say something like DKIM=pass or DKIM=OK.¹⁴ Move on when the sources in your inventory sign consistently.

Add the handling policy

DMARC decides what receiving systems should do after the SPF and DKIM checks, so add it after those authentication paths are ready. Configure the DMARC TXT records after configuring SPF and DKIM.¹⁵ Enabling DMARC before SPF or DKIM is ready will probably create delivery issues for messages sent from the domain.¹⁶ DMARC tells receiving servers what action to take when messages from the domain fail SPF or DKIM authentication.¹⁷ The available actions are reject, quarantine, or deliver the message.¹⁸

Add the policy as a DNS record, then use DMARC reports to validate the results.¹⁹ Start with a policy that lets you observe failures while you identify legitimate senders, especially when the sender inventory is incomplete. Once the reports match the systems you expect, decide how the receiving side should handle failures.

Verify alignment

A passing mechanism is useful for DMARC only when it belongs to the domain the recipient sees in the From address. Check the two alignment paths separately. For SPF, verify that the MAIL FROM domain and the From domain align.² For DKIM, verify that the domain in the signature aligns with the domain in the From address.²⁰ A service can authenticate through SPF and still fail this alignment check. Configure it to use your domain in MAIL FROM, or configure DKIM signing with your domain.²¹

Run this check for each sending source, including automated services and any subdomain. Inspect the message headers and compare the visible From address with the domains used by SPF and DKIM. Use the DMARC reports to find sources you missed and confirm that the receiving result matches the message you tested.

What not to do

These mistakes leave gaps between the record you publish and the mail you actually send.

• Do not treat DKIM as complete protection. DKIM alone cannot prevent spoofing of the domain, so SPF and DMARC are also required.²²
• Do not send the first email before SPF, DKIM, and DMARC pass.²³
• Do not assume a subdomain inherits the records it needs for DMARC. Each subdomain requires its own SPF and DKIM records.⁵