If your application's password reset emails, invoices, or notifications are landing in users' spam folders, your domain is failing authentication. With Google and Yahoo enforcing strict sender guidelines, every domain sending email must maintain valid SPF, DKIM, and DMARC DNS records. This guide shows you how to configure all three records correctly.
The Three Pillars of Email Authentication
- SPF (Sender Policy Framework): Specifies which IP addresses and mail servers are authorized to send mail on behalf of your domain.
- DKIM (DomainKeys Identified Mail): Attaches an asymmetric cryptographic signature to email headers, proving the email was not modified in transit.
- DMARC (Domain-based Message Authentication): Instructs receiving mail servers what action to take (none, quarantine, reject) if SPF or DKIM checks fail.
Step 1: Constructing an SPF TXT Record
SPF records live as standard TXT records at the root of your domain (@):
// Example Production SPF Record:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:82.29.199.147 -all
| Mechanism |
Purpose |
Warning |
include:example.com |
Authorizes third-party mail providers (Google Workspace, Postmark). |
Must stay under the hard 10 DNS lookup limit. |
ip4:x.x.x.x |
Authorizes direct server sending IP without burning a DNS lookup. |
Best for dedicated web hosting VPS/servers. |
-all (Hard Fail) |
Strictly rejects any email not originating from listed IPs. |
Recommended. Do not use ~all permanently. |
Step 2: Generating and Adding DKIM Keys
DKIM utilizes public-key cryptography. Your email server signs outbound messages with a private key, while receiving servers verify the signature using the public key published in your DNS:
# DNS Record Details:
Type: TXT
Host / Name: k1._domainkey.yourdomain.com
TTL: 3600
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0r... (2048-bit Public Key)
Pro Tip: Always use 2048-bit RSA keys. Outdated 1024-bit keys are actively flagged by Gmail security filters as vulnerable.
Step 3: Enforcing Strict DMARC Policies
Without DMARC, SPF and DKIM pass/fail statuses can be ignored by receiving filters. Publish your DMARC record at _dmarc.yourdomain.com:
# Stage 1: Monitoring Mode (Collect Reports without dropping mail):
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; sp=none; pct=100
# Stage 2: Quarantine Mode (Send unauthenticated mail to Spam):
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100
# Stage 3: Full Enforcement Mode (Drop fraudulent spoofed mail completely):
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100
Testing and Validating Your Configuration
After publishing your DNS records, verify propagation using command-line diagnostic tools:
# Check SPF Record via Terminal:
dig +short TXT yourdomain.com
# Check DKIM Selector:
dig +short TXT k1._domainkey.yourdomain.com
# Check DMARC Policy:
dig +short TXT _dmarc.yourdomain.com
Frequently Asked Questions
Can I have more than one SPF record on my domain?
Never publish multiple SPF TXT records. Having more than one SPF record causes an automatic PermError on receiving mail servers, causing all domain emails to fail authentication. Merge all authorized senders into a single v=spf1 string.
What does DMARC alignment mean?
DMARC alignment requires that the domain visible to the end user in the "From:" header matches the domain authenticated by SPF and/or DKIM.