SPF, DKIM and DMARC: the ten-minute explainer

Email was designed without any way to prove who sent a message. Anyone can put your domain in the From: field. These three records are the retrofit, and receiving servers now treat their absence as a signal in itself.

Here's what each one actually does, in the order they run.

SPF: which servers are allowed to send

SPF is a TXT record listing the servers permitted to send mail for your domain. A receiving server looks at where the message came from, looks up your SPF record, and checks whether that server is on the list.

v=spf1 include:mailyte.com ~all

Two things go wrong with SPF more than anything else:

• Two records. You're allowed exactly one SPF record per domain. Adding a second — usually when a second vendor's setup guide says "add this TXT record" — invalidates both.
• Too many lookups. Each include: costs a DNS lookup, and the limit is ten. Chain enough vendors together and you quietly exceed it, at which point SPF fails for everyone.

DKIM: proof the message wasn't altered

SPF authorises a server. DKIM authenticates the message. Your sending server signs each message with a private key, and publishes the matching public key in DNS. The receiver verifies the signature, which proves both that the message came from something holding your key and that nobody modified it in transit.

You don't manage the key material — Mailyte generates it, signs every message, and publishes the record for you to paste.

DMARC: what to do when the first two fail

DMARC ties SPF and DKIM to the domain the recipient actually sees, and tells receiving servers what you want done with mail that fails.

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

The policy is the important part:

• p=none — do nothing, just report. Useful for a week or two while you look at the data.
• p=quarantine — send failures to spam.
• p=reject — refuse them outright.

The rua= address is where aggregate reports go. Publish an address that exists, and read the reports before you tighten the policy — that's how you find the legitimate sender you'd forgotten about (the invoicing system, the CRM, the survey tool) before it starts getting rejected.

The order to do this in

1. Publish SPF, DKIM and DMARC with p=none.
2. Read a fortnight of aggregate reports and authorise anything legitimate you find.
3. Move to p=quarantine, then p=reject.
4. Keep checking. Records break long after setup.

Mailyte generates all four records for a domain and verifies them against live DNS, then keeps re-checking. If you'd rather just see where a domain stands today, the free check needs no account.