SPF, DKIM, and DMARC are the three DNS-based email authentication standards that Gmail, Outlook, and Yahoo now require for reliable inbox delivery. Without them, your emails are far more likely to be marked as spam or rejected outright.
What Each Record Does
- SPF — specifies which servers are authorized to send email for your domain
- DKIM — digitally signs outgoing emails so receivers can verify they weren't altered in transit
- DMARC — tells receiving servers what to do when SPF or DKIM checks fail, and provides reporting
Prerequisites
- A domain you control with DNS management access
- A configured mail server (Postfix, Exim, or a platform like Postal)
- Your VPS's sending IP address
Step 1 — Configure SPF
Add a TXT record at your domain's root:
Type: TXT
Name: @
Value: v=spf1 ip4:YOUR_SERVER_IP -allStart with ~all (soft fail) while testing, then switch to -all (hard fail) once confirmed working, for stronger protection against spoofing.
Step 2 — Generate and Configure DKIM
Generate a key pair using your MTA (example with OpenDKIM):
sudo apt install opendkim opendkim-tools -y
sudo mkdir -p /etc/opendkim/keys/yourdomain.com
sudo opendkim-genkey -s default -d yourdomain.com -D /etc/opendkim/keys/yourdomain.comThis generates a public key. Add it as a TXT record:
Type: TXT
Name: default._domainkey
Value: v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEYStep 3 — Configure DMARC
Type: TXT
Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]; pct=100Step 4 — Progress DMARC to Full Enforcement Gradually
| Policy | Meaning | When to Use |
|---|---|---|
p=none | Monitor only, no action | Initial setup, first 1–2 weeks |
p=quarantine | Failing emails sent to spam | After confirming SPF/DKIM pass consistently |
p=reject | Failing emails rejected entirely | Production, once fully validated |
Step 5 — Verify Your Records
dig TXT yourdomain.com
dig TXT default._domainkey.yourdomain.com
dig TXT _dmarc.yourdomain.comStep 6 — Send a Test Email and Check Headers
Send to a Gmail address, open the message, and select "Show original" to confirm:
SPF: PASS
DKIM: PASS
DMARC: PASSCommon Mistakes
- Publishing multiple SPF records for the same domain — only one is allowed; combine mechanisms into a single record instead
- Mismatched DKIM selector between DNS and the MTA configuration
- Enabling
p=rejectbefore confirming SPF/DKIM pass reliably, causing legitimate email to be rejected - Forgetting to update SPF when adding a new sending service (e.g. a third-party transactional email provider)
Common Errors
DKIM shows FAIL in test emails — verify the selector name matches exactly between your DNS record and MTA config, and that the key wasn't truncated when copied into DNS.
"Multiple SPF records found" — merge them into one record; having more than one is explicitly invalid per the SPF specification.
Best Practices
- Set up all three records together — SPF and DKIM alone provide limited protection without DMARC enforcement
- Review DMARC aggregate reports (
rua) regularly to catch authentication issues before they affect deliverability - Keep DNS records updated whenever you add or remove sending sources
FAQ
Do I need all three, or is SPF alone enough?
All three are recommended together — SPF alone is easily bypassed by "aligned" spoofing techniques that DKIM and DMARC specifically address.
Related Articles
- How to Set Up Reverse DNS (PTR/rDNS) for Email Deliverability
- IP Warm-Up: A Safe 30-Day Schedule for New Sending IPs
- How to Install and Configure Postfix as a Mail Transfer Agent
