You push a password reset flow to production, and users say they never got the email. Or a customer forwards you a message that looks like it came from your company, but you never sent it.

Both problems usually come from missing or misconfigured email authentication. At Zia Networks, this is one of the most common issues we see in business email setups and one of the easiest to fix once you understand it.

In this post, we'll cover what SPF, DKIM, and DMARC are, how they work together, and how to set them up step by step.

Why Email Authentication Matters

Email was designed in the 1980s, and SMTP has no built-in way to verify who is really sending a message. Anyone can set the address to ceo@yourcompany.com.

That leads to two problems:

  • Spoofing and phishing: attackers impersonate your domain.
  • Spam filtering: Gmail, Outlook, and Yahoo distrust unauthenticated mail, so even legitimate emails get junked.

SPF, DKIM, and DMARC are three DNS-based standards that solve this together.

SPF: Who Can Send Email for Your Domain?

SPF (Sender Policy Framework) is a DNS TXT record listing the servers and services allowed to send email for your domain.

v=spf1 include:_spf.google.com include:sendgrid.net -all
Part Meaning
v=spf1 Identifies the record as SPF
include: Authorises a third-party sender
-all Reject everything else (~all = soft fail)

Common SPF mistakes

  1. Multiple SPF records. Only one is allowed per domain.
  2. More than 10 DNS lookups. Too many include: entries break SPF.
  3. Forgotten senders. CRM, newsletter tool, helpdesk, and so on.
  4. Using +all. This authorises the entire internet.

Check your current record from the terminal:

dig +short TXT yourcompany.com | grep spf

Limitation: SPF checks the hidden envelope sender, not the visible ``address, and it often breaks on forwarded mail.

DKIM: Was the Email Tampered With?

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing message, like a wax seal on a letter.

  1. Your mail server signs the message with a private key.
  2. You publish the public key in DNS.
  3. The receiver verifies the signature using that public key.

`plaintext
Name: selector1._domainkey.yourcompany.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...
`

The selector1 part is the selector, which lets you run multiple keys, for example, one per email service.

Look up a DKIM record:

`bash
dig +short TXT selector1._domainkey.yourcompany.com
`

Common DKIM mistakes

  • Enabling DKIM in the provider but never publishing the DNS record
  • Using weak 512-bit keys (use 2048-bit)
  • Never rotating keys
  • Skipping DKIM for third-party senders

DMARC: What Happens When a Check Fails?

SPF and DKIM verify mail, but neither says what to do on failure. DMARC (Domain-based Message Authentication, Reporting & Conformance) adds:

  1. Alignment: the visible ``domain must match the domain verified by SPF or DKIM.
  2. Policy: monitor, quarantine, or reject failing mail.
  3. Reporting: reports showing who sends emails to your domain. 
Name: _dmarc.yourcompany.com Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com; pct=100
Policy Action When to use
p=none Monitor only Starting out
p=quarantine Failing mail goes to spam After fixing legitimate senders
p=reject Failing mail is blocked Full spoofing protection

DMARC passes if either SPF or DKIM passes and aligns with the From domain.

dig +short TXT _dmarc.yourcompany.com

How They Work Together

  • SPF checks where the email came from.
  • DKIM checks the email wasn't altered.
  • DMARC checks the results match the visible 'From' address and enforces a policy.

No single one is enough. Together they protect your brand and improve deliverability.

Why Your Emails Land in Spam

  1. No SPF, DKIM, or DMARC at all (Google and Yahoo now require authentication for bulk senders)
  2. SPF or DKIM failures from misconfiguration or a missing sender
  3. Alignment failures, where a third-party tool sends using its own domain
  4. Poor domain or IP reputation
  5. Content and list issues, such as spammy wording or purchased lists

Why Your Domain Gets Spoofed

  • No DMARC record, or one stuck on p=none forever
  • A weak SPF record with no DMARC backup
  • Unprotected subdomains and parked domains

Step-by-Step Setup

  1. Inventory every sender: mailbox provider, marketing tool, CRM, billing, helpdesk, and website forms.
  2. Publish one clean SPF record under the 10-lookup limit.
  3. Enable DKIM for every sender and test it.
  4. Start DMARC at p=none with a reporting address, and collect data for 2 to 4 weeks.
  5. Analyse the reports and fix legitimate senders that fail.
  6. Move gradually: none → quarantine (start with pct=10) → reject.
  7. Monitor continuously. New vendors mean new sending sources.

Testing Your Setup

  • MXToolbox for SPF, DKIM, and DMARC lookups
  • Send a test email to Gmail and click 'Show original' to see pass or fail results.
  • DMARC report analysers to turn raw XML into dashboards

Quick Checklist

  • [ ] One SPF record, under 10 lookups
  • [ ] DKIM enabled for every sending service
  • [ ] DMARC published with a reporting address
  • [ ] Policy moving toward quarantine or reject
  • [ ] Subdomains and parked domains covered
  • [ ] DMARC reports are reviewed regularly.

Final Thoughts

SPF, DKIM, and DMARC answer three simple questions: Who can send for you? Is the message authentic? And what happens if it isn't? Get them right and you'll see fewer emails in spam, far less impersonation risk, and a stronger domain reputation.

If you'd rather not untangle DNS records and DMARC reports alone, the team at Zia Networks can audit your email authentication, fix misconfigurations, and guide you to full DMARC enforcement.

Have you run into tricky SPF lookup limits or DMARC alignment issues? Share your experience in the comments. 👇