Skip to main content
SPF, DKIM and DMARC: How Correct DNS Records Ensure Secure Email Delivery

SPF, DKIM and DMARC: How Correct DNS Records Ensure Secure Email Delivery

How to get email into the inbox instead of the spam folder. Setting up SPF, DKIM and DMARC correctly: secure email delivery through proper authentication.

Many companies only notice the problem once customers or partners suddenly stop receiving their email: missing or misconfigured DNS records cause messages to be blocked or classified as spam. Gmail, Outlook and other large providers in particular now require unambiguous authentication of the sender. The key mechanisms for this are called SPF, DKIM and DMARC.

SPF – Proof of Sender

The Sender Policy Framework (SPF) checks whether the sending mail server is authorized to send email on behalf of a domain. Without a correct SPF record, many providers reject incoming messages.

A typical SPF record in DNS can look like this, for example:

v=spf1 ip4:85.13.137.187 mx a ~all

This rule defines which servers (in this case the IP address 85.13.137.187) are allowed to send mail for the domain. It is important that only one SPF record per domain exists, because duplicate entries lead to what are known as „permerror“ failures.

DKIM – The Digital Signature

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing email, which the receiving server verifies against the public key published in DNS. This makes it possible to confirm that the message was not altered in transit.

Longer DKIM keys have to be split into chunks of no more than 255 characters, with each chunk in quotation marks:

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B..."
"KZdVSC9+XAP+fq3trbOmhCVhL1GvMw/bpT/F5LH..."
"ux6Gttq+rUElQIDAQAB"

If DKIM is set up correctly, the email header shows verification results such as „DKIM=pass“ – a sign of successful authentication.

DMARC – The Guardian over SPF and DKIM

DMARC (Domain-based Message Authentication, Reporting and Conformance) combines SPF and DKIM and defines how recipients should handle messages that fail those checks. At the same time, DMARC provides daily reports on which servers are sending email on behalf of a domain.

A simple DMARC record in monitoring mode can look like this:

_dmarc  TXT  "v=DMARC1; p=none; rua=mailto:postmaster@domain.tld"

With p=none, no email is blocked – only reports are generated. These reports are usually sent by senders such as noreply-dmarc-support@google.com and contain an XML statistics file inside a ZIP archive. It records which IPs sent email on behalf of the domain and whether SPF and DKIM passed their checks.

Testing SPF, DKIM and DMARC

Once everything is in place, it is worth testing the email configuration. One of the most reliable platforms for this is mail-tester.com. After you send a test message to the address it provides, you get a full delivery report that lays out SPF, DKIM and DMARC results along with spam scores.

Best Practices

  • After a domain migration, always review the SPF, DKIM and DMARC records.
  • Only one SPF record per domain – duplicate entries cause failures.
  • Store DKIM keys in 255-character blocks wrapped in quotation marks.
  • DMARC reports help you spot abuse or spoofing early.
  • Check the configuration regularly with mail-tester.com.

Conclusion

Correctly configured email authentication is indispensable today. SPF, DKIM and DMARC not only protect against spam and phishing, they also improve deliverability and make you look professional. Configure these standards properly and check them regularly with tools like mail-tester.com, and you make sure your business email arrives where it belongs – in the inbox.

SPF, DKIM and DMARC: How Correct DNS Records Ensure Secure Email Delivery | BIT62