Email SPF/DKIM/DMARC Configuration: Improving Email Deliverability and Security
SPF, DKIM, and DMARC are the three core email authentication protocols. Correctly configuring them can significantly improve email deliverability and prevent spoofing and phishing attacks.
1. SPF (Sender Policy Framework)
SPF specifies which servers are authorized to send emails for your domain.
SPF Record Configuration
# DNS TXT Record
example.com. IN TXT "v=spf1 include:_spf.google.com ~all"
| Mechanism | Description |
|---|---|
| include | Allow sending servers of specified domain |
| ip4 | Allow specified IPv4 address |
| a | Allow domain's A record address |
| mx | Allow domain's MX record address |
| ~all | Soft fail (recommended) |
| -all | Hard fail (strict) |
2. DKIM (DomainKeys Identified Mail)
DKIM uses digital signatures to verify email integrity.
# DKIM DNS Record
google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."
3. DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC instructs email providers on how to handle emails that fail SPF/DKIM checks.
# DMARC DNS Record
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"
| Policy | Description |
|---|---|
| none | Monitor only, no action |
| quarantine | Mark as spam |
| reject | Reject directly |
4. Configuration Verification
# Online verification tools
dig TXT example.com # View SPF
dig TXT _dmarc.example.com # View DMARC
# Use MXToolbox to verify
# https://mxtoolbox.com/diagnostic.aspx