Email authentication guides
Plain-English guides to DMARC, SPF and DKIM: how they work, how to set them up for Google Workspace, Microsoft 365 and other senders, and how to reach p=reject safely.
Basics
- What is DMARC?DMARC tells receivers what to do with mail that fails SPF and DKIM for your domain and reports who sends as you. How it works, its tags and how to set it up.
- What is SPF?SPF lists the servers allowed to send mail for your domain. Learn SPF record syntax, include, ip4, ~all vs -all, the 10-lookup limit and common mistakes.
- What is DKIM?DKIM signs your email so receivers can tell it’s really from you and unchanged. How DKIM signatures, selectors and keys work, and how to set up and rotate them.
- DMARC alignmentDMARC passes only when SPF or DKIM passes for a domain matching the From address. What alignment means, relaxed vs strict, and how to fix alignment failures.
Fixing problems
- SPF “too many DNS lookups”SPF allows at most 10 DNS lookups; go over and SPF fails with a PermError. How lookups are counted, how to find costly includes, and safe ways to get under 10.
- Why DMARC failsThe common reasons legitimate mail fails DMARC: unaligned senders, missing DKIM, SPF over 10 lookups, forwarding and mailing lists. How to find each one and fix it.
Rolling out DMARC
- From p=none to p=rejectA step-by-step plan to take DMARC from monitoring to enforcement: find each sender, fix alignment, then step through quarantine to p=reject without losing mail.
- Reading DMARC reportsWhat’s inside a DMARC aggregate (RUA) report, what each XML field means, how to spot legitimate senders vs spoofing, and what to do with forensic (RUF) reports.
Requirements
Provider setup
- Google WorkspaceThe exact SPF, DKIM and DMARC records Google Workspace needs, where to add them and how to check they pass and align, so Google Workspace mail reaches the inbox.
- Microsoft 365The exact SPF, DKIM and DMARC records Microsoft 365 needs, where to add them and how to check they pass and align, so Microsoft 365 mail reaches the inbox.
- Amazon SESThe exact SPF, DKIM and DMARC records Amazon SES needs, where to add them and how to check they pass and align, so Amazon SES mail reaches the inbox.
- SendGridThe exact SPF, DKIM and DMARC records SendGrid needs, where to add them and how to check they pass and align, so SendGrid mail reaches the inbox.
- MailchimpThe exact SPF, DKIM and DMARC records Mailchimp needs, where to add them and how to check they pass and align, so Mailchimp mail reaches the inbox.
- MailgunThe exact SPF, DKIM and DMARC records Mailgun needs, where to add them and how to check they pass and align, so Mailgun mail reaches the inbox.
- PostmarkThe exact SPF, DKIM and DMARC records Postmark needs, where to add them and how to check they pass and align, so Postmark mail reaches the inbox.
- HubSpotThe exact SPF, DKIM and DMARC records HubSpot needs, where to add them and how to check they pass and align, so HubSpot mail reaches the inbox.
- SalesforceThe exact SPF, DKIM and DMARC records Salesforce needs, where to add them and how to check they pass and align, so Salesforce mail reaches the inbox.
- Zoho MailThe exact SPF, DKIM and DMARC records Zoho Mail needs, where to add them and how to check they pass and align, so Zoho Mail mail reaches the inbox.
- BrevoThe exact SPF, DKIM and DMARC records Brevo needs, where to add them and how to check they pass and align, so Brevo mail reaches the inbox.
- KlaviyoThe exact SPF, DKIM and DMARC records Klaviyo needs, where to add them and how to check they pass and align, so Klaviyo mail reaches the inbox.