DKIM, SPF, and DMARC Setup

SPF, DKIM, and DMARC are DNS-based controls that help receiving mail systems verify messages sent using your domain. Configure the records in the DNS zone authoritative for the domain. If DNS is hosted somewhere else, make the changes there.

Before you begin

  • Identify every service that sends email using your domain, including newsletters, billing systems, website forms, and StridX Mail.
  • Open the domain’s DNS management page.
  • Get the exact SPF and DKIM record values from the mail service’s domain or email configuration area. Record names and keys can vary by domain and server, so do not reuse values from another domain.

SPF

SPF identifies the sending services authorized to send mail for your domain.

  1. Find the SPF value supplied for your domain by StridX Mail.
  2. Add it as a TXT record at the domain root, often shown as @ in DNS management.
  3. If an SPF TXT record already exists, update that record to include the new authorized sender. Do not publish multiple SPF records for the same domain.
  4. Keep all legitimate sending services in the policy. Use only the exact mechanisms supplied by each service; do not add a guessed include value.

DKIM

DKIM adds a cryptographic signature to outgoing mail. The receiving system checks the public key published in DNS.

  1. Enable DKIM for the domain in the mail service’s email or domain settings.
  2. Copy the DKIM record name (selector) and value exactly as displayed. This is commonly a TXT record, though some services may provide a CNAME record.
  3. Create the record in the domain’s DNS zone. Enter the full host/name requested by the service, including the selector.
  4. Save the change and allow DNS time to update. Return to the mail service and use its check or verification action if available.

DMARC

DMARC tells receiving systems how to handle mail that fails authentication checks and can send reports about those results.

  1. Confirm that SPF and DKIM are passing and aligned with the domain in the visible From address.
  2. Create a TXT record named _dmarc at the domain root.
  3. Begin with a monitoring policy, for example:

v=DMARC1; p=none; rua=mailto:[email protected]

Replace the report address with a monitored mailbox that can receive aggregate reports. Create that mailbox or use a report service before publishing the address. 4. Review reports and identify all legitimate senders. Fix their SPF or DKIM configuration before enforcing a stricter policy. 5. When all valid senders pass and align, consider moving gradually to p=quarantine and then p=reject. Monitor reports after each change.

Verify the records

  • Confirm there is one SPF record at the domain root.
  • Confirm the DKIM record name and value match the mail service’s instructions exactly.
  • Confirm the DMARC record is published at _dmarc.yourdomain.com and has valid syntax.
  • Send a message to an external mailbox and inspect its authentication results, or use the verification tools provided by your mail and DNS services.

DNS changes may take time to appear everywhere. A record can be correct in the DNS editor but still need time to propagate or may have been added to a non-authoritative DNS zone.