SPF, DKIM, DMARC, PTR, and BIMI Records: Complete Setup Guide

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. What Does DMARC Alignment Mean in Practice? “Alignment is the reason a message can pass SPF and still fail DMARC.” DMARC compares the domain in the visible From: header against the domain that SPF authenticated (the Return-Path) or the domain in the DKIM d= tag. If neither matches, the message fails DMARC regardless of how cleanly SPF or DKIM passed on their own. Google’s sender guidelines FAQ confirms that only one of the two needs to align, though aligning both is more reliable.

   In Authentication alignment

2. Alignment is the reason a message can pass SPF and still fail DMARC. “DMARC compares the domain in the visible From: header against the domain that SPF authenticated (the Return-Path) or the domain in the DKIM d= tag.” This is where email service providers cause problems. A marketing platform that sends with its own Return-Path domain will pass SPF against its domain, not yours. Unless that platform also signs with DKIM using your domain in the d= tag, your campaigns fail DMARC while your regular mail passes. Configure custom DKIM signing with any bulk sending platform you use, not just the SPF include.

   In Authentication alignment

3. Each TXT lookup should return exactly one relevant record. Two SPF records or two DMARC records mean something needs to be removed. The reverse lookup should return a hostname that resolves back to the same IP. “If DMARC shows FAIL while SPF and DKIM pass, you have an alignment problem, not an authentication problem.” Public tools such as MXToolbox will validate record syntax and flag SPF lookup count issues. A dedicated BIMI validator is worth running separately, since it checks the SVG profile and certificate chain that a general DNS tool will not inspect.

   In Authentication alignment

4. They solve five different problems, which is why publishing only one leaves gaps. “DMARC What should the receiver do when SPF or DKIM fails? TXT at _dmarc.yourdomain.com You” SPF and DKIM are authentication mechanisms. DMARC is the policy layer that sits on top of them and provides reporting. PTR is an infrastructure prerequisite that has nothing to do with your domain’s DNS zone. BIMI is a display feature that only activates once the first four are in order.

   In DMARC policies

5. How To Confirm Your Records Are Working “Check DNS first, then check an actual delivered message.” From a terminal:

   In Email address validation

6. How Does SPF Verify Your Sending Servers? “SPF publishes a list of authorized sending sources as a single TXT record on your domain.” A typical cPanel-generated record looks like this:

   In SPF records