Email authentication helps receiving systems assess whether a message is authorized to use your domain. SPF identifies permitted sending systems, DKIM adds a verifiable signature, and DMARC checks domain alignment and publishes handling preferences. These records support delivery, but they do not guarantee inbox placement or replace permission-based mailing practices.
Recommended workflow
- List all services that send email using your domain, including the website and any marketing or billing applications.
- Obtain the exact SPF and DKIM values from each authorized mail provider; do not copy example values unchanged.
- Check public DNS, then inspect a delivered message header to confirm the expected authentication results and alignment.
Publish changes at the authoritative DNS provider. A record displayed in a hosting control panel has no public effect if another provider hosts the active DNS zone. Keep one SPF record for the same hostname, and combine approved senders rather than creating competing records.
Introduce a restrictive DMARC policy only after you understand every legitimate sender and review test results or reporting. Website forms, invoicing applications and newsletters may use different delivery systems. Keep private signing keys confidential and copy only the public DKIM record into DNS. After a change, retain the previous zone values and verify a new external test message.
