SPF, DKIM and DMARC for Sending Infrastructure
Build aligned authentication for dedicated and multi-customer email infrastructure.
Authentication roles
SPF authenticates the envelope path, DKIM authenticates a signed message identity, and DMARC evaluates alignment with the visible From domain. Passing one does not replace the others.
SPF
example.com. 3600 IN TXT "v=spf1 ip4:192.0.2.10 -all"Keep DNS lookups within protocol limits and publish SPF on the actual envelope-from domain.
DKIM
Generate keys securely, keep private keys on the signing system and publish the public key at the selected selector._domainkey name. Rotate keys using overlapping selectors.
DMARC
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=s; aspf=s"Begin with reporting, study legitimate sources, then strengthen policy when alignment is understood.
Delegated customer setup
CNAME delegation can let a provider control DKIM records and return-path infrastructure while the customer controls the visible domain. Document exactly which names are delegated and which system holds each private key.
Validation
- Check authoritative DNS
- Send to independent mailbox providers
- Inspect Authentication-Results
- Verify DMARC alignment, not only pass/fail
- Test key rotation and failure handling