Overview

SPF, DKIM and DMARC are three DNS records that prove your emails are legitimate and tell receivers how to handle forgeries. Setting them up greatly improves deliverability and protects your domain from being spoofed. This article explains each record and how to publish them.

Before you begin

• A domain whose DNS you manage in the ALYPOD Console.
• A mail server or mail service that sends mail as your domain.
• The DKIM public key supplied by your mail server/software.

The three records

• SPF (a TXT record at the root) lists which servers may send mail for your domain.
• DKIM (a TXT record at a selector host) publishes a public key so receivers can verify a cryptographic signature on each message.
• DMARC (a TXT record at _dmarc) tells receivers what to do when SPF or DKIM fails, and where to send reports.

Steps

1. SPF. In the ALYPOD Console, add a TXT record at @ with a value such as:

v=spf1 mx a:mail.example.com -all

-all means "reject everything not listed". Use ~all (soft fail) while you are still testing.

1. DKIM. Your mail software generates a key pair and gives you a selector and public key. Add a TXT record at <selector>._domainkey with the key value, for example default._domainkey.

2. DMARC. Add a TXT record at _dmarc with:

v=DMARC1; p=none; rua=mailto:[email protected]

Start with p=none to collect reports without affecting delivery. Once reports look clean, move to p=quarantine and eventually p=reject.

1. Save all records and verify:

bash dig +short TXT example.com dig +short TXT default._domainkey.example.com dig +short TXT _dmarc.example.com

1. Send a test message to a service such as a mail-tester and confirm SPF, DKIM and DMARC all pass.

Good practice

• Keep exactly one SPF record; merge sources into a single string.
• Include your sending IPs or use mx/include: mechanisms rather than broad ranges.
• Make sure the return-path domain also passes SPF.

Troubleshooting

• Problem: DKIM fails. Solution: Check the selector name and confirm the public key was pasted without line breaks.
• Problem: DMARC reports show failures. Solution: Review rua reports, then add the missing senders to SPF or fix DKIM before tightening the policy.

Related articles

• [Managing DNS records (A, AAAA, CNAME, MX, TXT)]
• [Setting the reverse DNS (PTR) record]