DMARC, SPF, DKIM - Email Sending Requirements

DMARC, DKIM, and SPF are three email authentication methods. Together, they help prevent spammers, phishers, and other unauthorized parties from sending emails on behalf of a domain they do not own. DMARC tells mail servers what to do when DKIM or SPF fail, whether that is marking the failing emails as "spam," delivering the emails anyway, or dropping the emails altogether.

Back in October 2023, Google and Yahoo jointly announced new email sender requirements for inbound mail to their domains that they would be putting in place early February 2024. If you do not have a DMARC record, the one we are suggesting below (ex. v=DMARC1; p=none;) is the minimal valid record. It is safe to add without having any adverse impacts on any of your organizations mail, and will be useful for establishing the legitimacy of the email you’re sending.

1. DMARC

What is DMARC? Domain-based Message Authentication Reporting and Conformance (DMARC) is a method of authenticating email messages. A DMARC policy tells a receiving email server what to do after checking a domain's Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records, which are additional email authentication methods.

DMARC DNS Setup:
Host Name:  _dmarc
Record Type:  TXT
Address:  v=DMARC1; p=none;

Example Record:

Check Your DMARC Record:
https://dmarcian.com/dmarc-inspector/
https://dmarcian.com/yahoo-and-google-dmarc-required/

Add your DMARC record: https://support.google.com/a/answer/2466563?hl=en
Read more on DMARC: https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/

2. SPF

What is SPF? A sender policy framework (SPF) record is a type of DNS TXT record that lists all the servers authorized to send emails from a particular domain. A DNS TXT (“text”) record lets a domain administrator enter arbitrary text into the Domain Name System (DNS). TXT records were initially created for the purpose of including important notices regarding the domain, but have since evolved to serve other purposes.

SPF DNS Setup:
Host Name:  @
Record Type:  TXT
Address Example (Google Workspace):  v=spf1 include:_spf.google.com ~all
Address Example (Microsoft 365): v=spf1 include:spf.protection.outlook.com ~all
Address Example (Two Combined): v=spf1 include:_spf.google.com include:_spf.createsend.com ~all
Address Example (Campaign Monitor): v=spf1 include:_spf.createsend.com ~all

Example Record:

Check Your SPF Record:
https://dmarcian.com/spf-survey/

Adding SPF at your domain provider: https://support.google.com/a/answer/10684623?hl=en
Read more on SPF: https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/
Read more on multiple SPF Records: https://support.cloudways.com/en/articles/5241822-how-to-merge-multiple-spf-records

3. DKIM

What is DKIM? DomainKeys Identified Mail (DKIM) is a method of email authentication that helps prevent spammers and other malicious parties from impersonating a legitimate domain.

DKIM DNS Setup:
Generate New Record: DKIM Key Bit 2048 or 1024 (Enom Example)
Host Name:  *** generated at your email host ***
Record Type:  TXT OR CNAME depending
Address: Note: This is generated at your email host. View the example in the photo, this is a example in Google Workspace.

Example Record:

MS 365 Example -
CNAME Host Name : selector1._domainkey
Points to address or value: selector1-yourdomainname-com._domainkey.yourdomainname.onmicrosoft.com
CNAME Host Name : selector1._domainkey
Points to address or value: selector1-yourdomainname-com._domainkey.yourdomainname.onmicrosoft.com

Check Your DKIM Record:
https://dmarcian.com/dkim-inspector/

Some Registrars such as ENOM only support 1024 bit DKIM keys.
Turn on DKIM for your domain at Google Workspace: https://support.google.com/a/answer/180504?hl=en
Read more on DKIM: https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/

Additional reading:

https://www.cloudflare.com/learning/email-security/dmarc-dkim-spf/
https://www.valimail.com/blog/the-gmail-dmarc-policy-update-you-may-not-know-about/
https://mxtoolbox.com/ - MX Record, SPF, DKIM & DMARC Lookup tool

Last Updated: 2024-08-05