How To Set Up SPF, DKIM, DMARC
Here's a quick guide to setting up email authentication protocols:
SPF: Checks if sending server is allowed to send emails for your domain
DKIM: Adds a digital signature to your emails
DMARC: Uses SPF and DKIM to handle suspicious emails
Why bother? These protocols:
Boost email deliverability
Build trust with email providers
Protect your domain reputation
Setting up is straightforward:
SPF: Add a TXT record to your DNS listing approved IP addresses
DKIM: Generate key pair, add public key to DNS, configure email server
DMARC: Create policy, add TXT record to DNS, set up reporting
SPF
Checks sender's IP
Guest list
DKIM
Adds signature
Wax seal
DMARC
Manages SPF and DKIM
Security manager
Remember: Start with lenient policies, then tighten over time. Regular checks and updates are key.
Email Authentication Basics
Email authentication is your inbox's bouncer. It checks if emails are legit. Let's look at the three main bouncers: SPF, DKIM, and DMARC.
What is SPF?
SPF (Sender Policy Framework) is like a guest list for your domain's emails. Here's how it works:
You make an SPF record in your DNS.
This record lists approved IP addresses for sending emails.
Receiving servers check if the sending IP is on the list.
If it's not listed? The email might end up in spam or get rejected.
What is DKIM?
DKIM (DomainKeys Identified Mail) is like a wax seal for your emails. It works like this:
Your server adds a unique signature to outgoing emails.
The receiving server checks this signature against your DNS.
A valid signature proves the email wasn't messed with in transit.
What is DMARC?
DMARC manages SPF and DKIM. It tells servers what to do with emails that fail these checks. DMARC:
Checks if SPF and DKIM passed
Verifies if the "From" address matches the domain that passed SPF/DKIM
Tells the server how to handle failed emails
How They Work Together
These three team up to protect your email:
SPF
Checks sender's IP
Guest list
DKIM
Adds signature
Wax seal
DMARC
Manages SPF and DKIM
Security manager
When an email arrives, servers:
Check SPF to verify the sender's IP
Verify DKIM to ensure the email's intact
Follow DMARC policy to decide what to do
This triple-check makes it tough for scammers to fake your domain. It's not perfect, but it's solid protection against email fraud.
Before You Start
You need a few things in place before setting up SPF, DKIM, and DMARC. Here's what you'll need:
Domain Control
You must own your domain. This means:
A registered domain (like yourbusiness.com)
Access to manage DNS records
Free email services won't work. You need a custom domain.
DNS Record Access
You'll be adding TXT records to your DNS. To do this:
Log into your domain provider's control panel
Find DNS management or settings
Look for the option to add new DNS records
Can't find it? Check your provider's help docs or contact support.
Email Provider Information
Your email service has crucial info you'll need:
DKIM keys
Authorized IP addresses for SPF
Recommended DMARC settings
Most providers have a page for this. If not, ask their support team.
Account dashboard > Domains section
Admin console > Apps > Google Workspace > Gmail > Authenticate email
Admin center > Setup > Domains
Heads up: From February 2024, Gmail and Yahoo will require these authentications for bulk senders (over 5,000 emails/day). It's smart to set this up now.
Setting up SPF
SPF (Sender Policy Framework) helps protect your domain from email spoofing. Here's how to set it up:
Finding DNS Settings
Log into your domain provider's control panel and look for "DNS Management" or "DNS Settings". You'll need to add new DNS records here.
Can't find it? Check your provider's help docs or contact support.
Making an SPF Record
To create an SPF record:
Choose "Add new record" in DNS settings
Select "TXT" as the record type
Set the host to "@" or your domain name
Enter your SPF record in the TXT value field
SPF Record Structure
A basic SPF record looks like this:
v=spf1 [mechanisms] [all]
v=spf1: Always starts the SPF record
mechanisms: List of approved servers/IPs
all: How to handle non-matching servers
Common SPF Settings
Here's a quick look at common SPF mechanisms:
ip4
Allows specific IPv4 address
ip4:192.0.2.0
ip6
Allows specific IPv6 address
ip6:2001:db8:85a3::8a2e:370:7334
a
Allows domain's A record
a
mx
Allows domain's MX records
mx
include
Allows another domain's SPF
include:thirdpartydomain.com
Checking SPF Setup
After setting up your SPF record:
Wait 24-48 hours for DNS changes to spread
Use an SPF record checker tool
Send a test email and check the headers
Setting up DKIM
DKIM adds a digital signature to your emails. Here's how to set it up:
Creating DKIM Keys
Log into your email provider's settings
Find DKIM or email authentication options
Generate a new DKIM key pair
In Google Workspace:
Go to Apps -> Google Workspace -> Gmail -> Authenticate email
Click "Generate new record"
Adding DKIM to DNS
Access your domain's DNS settings
Create a new TXT record
Use this format: selector._domainkey.yourdomain.com
Paste the public key in the record value
Example DKIM record:
TXT
selector1._domainkey
k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4G...
Setting Up Email Server for DKIM
Save the private key to your email server
Configure your server to use DKIM signing
For Microsoft 365:
Go to Home -> Policy -> DKIM
Select your domain
Enable DKIM signatures
Testing DKIM
After setup:
Wait 24-48 hours for DNS changes
Send a test email to an external address
Check the email headers for a DKIM-Signature field
Use online DKIM checkers to verify your setup. If something's off, double-check your DNS records and server config.
Setting up DMARC
DMARC adds another security layer to your email setup. Here's how to do it:
Create a DMARC Policy
1. Pick a policy level:
p=none: Watch without affecting delivery
p=quarantine: Send iffy emails to spam
p=reject: Block emails that fail DMARC
2. Start with p=none. It lets you gather data without messing up legit emails.
Add DMARC to DNS
Get into your domain's DNS settings
Make a new TXT record
Use this host format: _dmarc.yourdomain.com
Pop in the DMARC policy as the value
Here's what a DMARC record looks like:
DMARC Settings Breakdown
v=DMARC1: DMARC version
p=: How to handle failed checks
rua=: Where to send reports
pct=: % of messages under policy
Set Up DMARC Reports
Make an email just for DMARC reports
Add rua= to your DMARC record
Optional: Use ruf= for detailed failure reports
DMARC reports show you:
Source IP addresses
SPF and DKIM results
How many messages were sent
Tips for SPF, DKIM, and DMARC
Keep Your Settings Sharp
Don't let your email authentication get rusty:
Check SPF records every few months
Rotate DKIM keys yearly
Set up alerts for DMARC changes
Ramp Up DMARC Slowly
Start small, then crank it up:
1. p=none: Watch and learn
2. p=quarantine: Spam-folder the sketchy stuff
3. p=reject: Block all bad emails
p=none
Just watches
Day one
p=quarantine
Spam-folders iffy emails
After some watching
p=reject
Blocks bad emails
When you're sure
Handle Outside Senders
Be smart with third-party emails:
Use subdomains for external folks
Make them send through your servers
Test their emails often
"Tell vendors about DMARC Alignment, DKIM Domains, and email headers", says Josh Stein from Proofpoint.
Fixing Common Problems
Email authentication can be a pain. Let's tackle the big issues.
SPF Record Mistakes
SPF records often cause headaches. Watch out for:
Multiple SPF records
Too many lookups
Syntax errors
How to fix:
1. Audit your SPF record
Use MXToolbox to spot errors.
2. Simplify
Ditch hard-coded IPs. Use include: statements instead.
3. Test
Send test emails after changes.
DKIM Key Issues
DKIM problems can sneak up on you. Look for:
Mismatched keys
Expired keys
Incorrect syntax
The fix:
1. Check your keys
Use a DKIM validator to make sure they're set up right.
2. Set a reminder
Rotate keys yearly.
3. Double-check syntax
Small errors = big problems.
DMARC Policy Conflicts
DMARC ties it all together, but it can cause trouble:
Overly strict policies
Misconfigured reporting
Alignment issues
How to solve:
1. Start slow
Use p=none to monitor without blocking emails.
2. Set up reporting
Use both rua and ruf tags in your DMARC record.
3. Check alignment
Make sure your "From" domain matches your SPF and DKIM domains.
p=none
Monitor only
Starting out
p=quarantine
Send to spam folder
After monitoring
p=reject
Block emails
When confident
Email authentication isn't a set-it-and-forget-it deal. Keep checking and tightening your policies.
"Almost 1 million internet domains have misconfigured DMARC records, posing significant email security risks", reports a recent study. Don't be one of them.
Helpful Tools
Setting up SPF, DKIM, and DMARC can be a headache. But don't worry - there are tools to make it easier.
DNS Record Checkers
These tools help you spot issues in your setup:
MXToolbox's SuperTool: Checks SPF, DKIM, and DMARC records
Email Authentication Tests
Want to test your setup? Try these:
DKIM Validator: Makes sure your public DKIM key works
SPF Surveyor: Finds problems in your SPF record
DMARC Inspector: Checks your DMARC policy for issues
DMARC Report Tools
DMARC reports can be a pain to read. These tools help:
XML-to-human Converter: Makes complex XML readable
DMARC Report Analyzer: Breaks down aggregate XML and forensic reports
DMARCLY
No
$17.99/month (2 domains)
Blocklist monitoring, forensic reporting
These tools can save you time and headaches. Pick the one that fits your needs and budget.
Conclusion
SPF, DKIM, and DMARC aren't just tech jargon. They're your secret weapons for protecting your real estate domain and keeping your lead communication on point.
Here's the lowdown:
Spam is everywhere: 84% of global emails are junk. These protocols are your shield.
Inbox, not spam folder: Get your emails where they belong.
ISPs will love you: Build trust and boost your domain's street cred.
Get ready for 2024: Gmail and Yahoo are upping their game. You should too.
Stay on top of it: This isn't a set-it-and-forget-it deal. Keep checking and updating.
But don't stop there. To keep your domain reputation sparkling:
Keep spam complaints under 0.1%
Aim for 0.5% unsubscribe rates
Use double opt-in for new subscribers
Clean your list regularly
Last updated
Was this helpful?