SPF, DKIM and DMARC: What They Do and How to Configure Them

Email authentication in plain language

Mailbox providers decide whether to accept, quarantine, or reject mail using reputation signals and authentication results. SPF, DKIM, and DMARC are DNS-published policies that help receivers verify senders. They do not replace good list hygiene or engaged subscribers, but missing or broken records frequently cause spam folder placement and bounces.

Vcom Web Tech configures these records for transactional systems, marketing platforms, and self-hosted mail servers. Understanding each record's job prevents the common mistake of copying a template without aligning it with the actual sending infrastructure.

Authentication is domain-scoped. Subdomains need their own policies when mail sends from them. A perfect root domain DMARC policy does not protect mail.yourdomain.com unless you publish records there too.

SPF: who may send for your domain

SPF is a TXT record listing authorized senders. Include mechanisms such as ip4, include for third-party providers, and a soft or hard fail qualifier. Stay within the ten DNS lookup limit; chained includes break SPF in subtle ways that show up only at certain receivers.

When both Google Workspace and SendGrid send mail, combine includes carefully and avoid duplicate mx mechanisms unless necessary. Use SPF survey tools after every DNS change.

SPF validates the envelope sender, not always the visible From header. That gap is one reason DKIM and DMARC exist.

DKIM: cryptographic signatures on messages

DKIM signs message headers and body with a private key; receivers verify using a public key published in DNS TXT records at selectors such as default._domainkey. Rotate selectors when changing providers so old mail in transit still verifies during cutover windows.

Ensure your sending platform signs mail with a domain aligned to your brand. Some relays offer shared domains for convenience; dedicated DKIM keys on your domain improve trust and reporting clarity.

Broken DKIM often traces to mailing list rewriters, forwarding through providers that strip signatures, or body modifications in HTML optimizers. Test with seed inboxes at major providers after template changes.

DMARC: policy and alignment

DMARC publishes what receivers should do when SPF or DKIM fail alignment checks relative to the From domain. Start with p=none to collect aggregate reports without risking delivery interruption. Move to quarantine and reject only after reports show legitimate mail passing.

Configure rua addresses to receive XML aggregate reports and optionally ruf for forensic samples where privacy policies allow. Parse reports to find unauthorized senders and stale SPF includes.

Alignment modes adkim and aspf matter for subdomains and third-party senders. Strict alignment reduces spoofing risk but requires meticulous DNS maintenance.

Operational checklist

Document every service that sends mail: CRM, ticketing, ecommerce, cron scripts on VPS hosts, and SaaS tools. Each needs SPF authorization and ideally DKIM signing on your domain or a dedicated subdomain.

Use a subdomain such as notifications.example.com for automated mail so marketing reputation issues do not drag down password resets on the root domain.

Revisit DNS after migrating IP addresses, changing SMTP relays, or adding new SaaS vendors. Authentication drift is a slow incident that surfaces as deliverability complaints weeks later.

Measuring success beyond the DNS panel

Valid syntax in a DNS editor does not guarantee inbox placement. Monitor bounce rates, spam complaint rates, and postmaster tools at Gmail and Yahoo. DMARC aggregate reports reveal which IP addresses send as your domain and whether they pass alignment.

Pair authentication with reverse DNS, forward-confirmed reverse DNS for self-hosted SMTP, and sensible envelope sender domains. Authentication records are one layer in a broader deliverability program Vcom Web Tech implements for clients moving off shared hosting.

When in doubt, send low-volume test campaigns to controlled seed lists before announcing a new mail platform to customers.

Additional operational notes

Operational excellence on Linux hosting requires documenting every change to Nginx, systemd, PM2, Docker, and DNS in a runbook your team shares. Vcom Web Tech clients benefit when staging environments mirror production firewall rules, TLS versions, and mail authentication so surprises appear before customers notice. Schedule quarterly reviews of backups, certificate expiry, DMARC reports, and monitoring alerts even when traffic feels stable.

When incidents occur, capture timelines and root causes in blameless postmortems. Patterns from past 502 errors, failed renewals, or bounce spikes inform checklists for the next deployment. Training new team members on SSH access, log locations, and escalation paths reduces dependency on single maintainers.

Security patches, dependency upgrades, and framework migrations should ride the same CI pipelines that deploy application code. Automate smoke tests that hit health endpoints and send test mail through staging SMTP relays. Small consistent investments beat heroic firefighting during launch weekends.

Capacity planning matters on VPS hosts where vertical scaling has limits. Watch disk inode usage, connection counts, and database connection pools as traffic grows. Proactive upgrades cost less than emergency migrations during peak sales or campaign sends.

Finally, communicate with stakeholders using plain language about risk, downtime windows, and deliverability metrics. Technical depth supports trust when email authentication or deployment strategy changes affect revenue-facing systems.