Understanding SPF, DKIM, and DMARC

Inventory authorised mail senders and use your provider’s instructions to configure domain email authentication.

Before you begin

You need authorised DNS access, the email provider’s configuration instructions and a list of every system sending mail for the domain. Include marketing tools, applications and existing providers. Do not replace production records with copied examples without reviewing all senders.

Work through the checklist

1. Inventory senders. List the mailbox provider, website or application mail services and other approved senders. Identify who owns each configuration.
2. Review SPF. SPF describes authorised sending infrastructure through a DNS record. Use provider instructions and account for all legitimate senders rather than adding unrelated records.
3. Prepare DKIM. DKIM signs mail using provider-managed or configured keys. Obtain the provider’s DNS value and enable the signing configuration as instructed.
4. Review DMARC. DMARC uses authentication alignment and a domain policy. Review reporting and legitimate traffic before adopting a stricter policy.
5. Validate real mail. Send representative messages through every approved sender and examine authentication results with the administrator. Document changes and follow provider troubleshooting guidance.

Mail routing and authentication have different roles

The records that route incoming mail and the records that help authenticate outgoing mail serve different purposes. A correct mailbox destination does not prove that application mail is authenticated. Review website forms and business systems alongside user mailboxes.

Example and limits

A domain sending employee mail and website notifications needs both senders included in the review. No universal SPF string, DKIM key or DMARC policy is supplied here; use current instructions for the selected providers and domain.

Document the next action

Record the decisions, the person authorised to approve changes and the evidence used to validate the result. Keep passwords, private keys and confidential business data out of planning notes shared through an initial enquiry. Revisit the record when the application, access requirements or commercial agreement changes.

Primary references

• Google Workspace SPF guidance
• Google Workspace DKIM guidance
• Google Workspace DMARC guidance