SPF, DKIM and DMARC, explained.

The problem: anyone can write your name on an envelope

Email was designed without any check of who the sender really is. A fraudster can send a message from invoices@example.com without ever touching your systems. Invoice fraud and CEO fraud often start exactly like this.

SPF, DKIM and DMARC let receiving mail servers check whether a message claiming to be from your domain really is. All three are published as records in your DNS.

SPF: who may send

A Sender Policy Framework record lists the servers allowed to send mail for your domain. It is a TXT record on the domain itself:

example.com.  TXT  "v=spf1 include:_spf.mailprovider.example -all"

• include: adds the senders of a provider, such as your mail service or newsletter tool.
• -all says everything else fails. ~all is a softer "probably not", common while you are still checking.
• An SPF record may cause at most ten DNS lookups. Too many include: entries break it.

DKIM: a signature on every message

DomainKeys Identified Mail adds a cryptographic signature to each message. Your mail service signs with a private key; the public key sits in your DNS under a selector, for example selector1._domainkey.example.com. A receiver checks that the message was signed by your domain and not changed on the way.

Each service that sends for you, such as your mailbox provider, your newsletter tool or your invoicing system, should sign with your domain. Most of them guide you through it.

DMARC: what to do when the checks fail

DMARC ties the two together. It asks receivers to check that SPF or DKIM passes for the domain the reader sees in the From line, and tells them what to do if neither does:

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

• p=none: only report. Spoofed mail is still delivered.
• p=quarantine: failing mail goes to spam.
• p=reject: failing mail is refused. This is the goal.
• rua=: where receivers send daily reports of who sent mail in your name.

A safe path to p=reject

1. Publish SPF and enable DKIM for every service that sends for you.
2. Publish DMARC with p=none and a report address, and read the reports for a few weeks.
3. Fix the senders that fail: usually a forgotten tool or a provider without DKIM.
4. Move to p=quarantine, then to p=reject.

Domains that never send mail are the easiest: publish v=spf1 -all and a DMARC record with p=reject, so nobody can use them either.

Three more records worth knowing

• MTA-STS tells other mail servers to deliver to you over an encrypted connection only.
• TLS-RPT gives them an address to report problems with that encryption.
• DNSSEC signs your DNS answers, so nobody can forge the records above on the way.