{"id":1514730,"date":"2022-11-28T06:00:25","date_gmt":"2022-11-28T11:00:25","guid":{"rendered":"https:\/\/www.practicalecommerce.com\/?p=1514730"},"modified":"2023-11-16T10:39:00","modified_gmt":"2023-11-16T15:39:00","slug":"how-spf-dkim-dmarc-drive-email-delivery-security","status":"publish","type":"post","link":"https:\/\/www.practicalecommerce.com\/how-spf-dkim-dmarc-drive-email-delivery-security","title":{"rendered":"How SPF, DKIM, DMARC Drive Email Delivery, Security"},"content":{"rendered":"

A trio of email authentication standards work together to improve email deliverability for the sender and email safety for the recipient.<\/p>\n

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) help to ensure that emails sent from your company are real and that malicious actors are not spoofing or otherwise tampering with them.<\/p>\n

SPF, DKIM, DMARC<\/h3>\n

SPF, DKIM, and DMARC show the receiving email server that a given message was sent from an authorized IP address, that the sender is authentic, and that the sender is transparent about its identity.<\/p>\n

Let’s take each one in turn.<\/p>\n

Setting up SPF records for your domain involves adding a type of TXT record containing an authorized list of outgoing mail servers to the Domain Name System (DNS). SPF verifies that emails from your business’s domain come from an authenticated source, not an imposter.<\/p>\n

DKIM keys consist of two parts: a public key stored in the DNS and a private key stored on the sending mail server. The DKIM signature attached to each outgoing email is used by recipients’ mail servers to verify its authenticity. DKIM can also indicate if a given email message has been altered.<\/p>\n

DMARC is a policy mechanism that allows a company to control how incoming emails from its domain should be handled if they fail the SPF or DKIM authentication. The options are “reject,” “quarantine,” or “none.” This can be like an alarm bell if a wrong-doer is trying to use your domain.<\/p>\n

SPF Records<\/h3>\n

Setting up an SPF record requires access to your domain’s DNS records at the registrar, such as GoDaddy or similar. If you have ever had to verify your domain or move it to a new server you likely updated its DNS record.<\/p>\n

\"Screenshot

An SPF record is simply a TXT record in your domain’s DNS.<\/p><\/div>\n

The SPF record will be of the type “TXT.” And it will start with the version of SPF you are using.<\/p>\n

v=spf1<\/pre>\n
The version is followed by a list of authorized IP4 or IP6 addresses, as in:<\/p>\n
v=spf1 ip4:192.168.0.1<\/pre>\n
This SPF record would authorize emails from the 192.168.0.1 IP address. To allow a range of IP addresses, you could use Classless Inter-Domain Routing (CIDR) notation (sometimes called “slash” notation).<\/p>\n
v=spf1 ip4:192.168.0.0\/16<\/strong><\/pre>\n
The above SPF record would authorize a range of IP addresses from 192.168.0.0 to 192.168.255.255 \u2014 this is what the “\/16” indicates.<\/p>\n
Using the prefix “a,” an SPF record can authorize a domain by name. The record below authorizes a server associated with the example.com domain.<\/p>\n
v=spf1 a:example.com<\/pre>\n
Similarly, the prefix “mx” (“mail exchange”) authorizes specific mail servers.<\/p>\n
v=spf1 mx:mail.example.com<\/pre>\n
To authorize a third-party sender, use the prefix “include.” The example below permits both an IP range and Google servers.<\/p>\n
v=spf1 ip4:192.168.0.0\/16 include:_spf.google.com<\/pre>\n
There are also two SPF qualifiers. The first is ~all with a tilde (~). The second is -all with a hyphen (-).<\/p>\n
The tilde version (~all) is a soft-fail qualifier. In most cases, the receiving email server will accept messages from senders that aren’t in the associated SPF record but consider them to be suspicious.<\/p>\n
The hyphen version (-all) is a hard-fail qualifier. The receiving email server will likely label messages sent from a server not authorized in the SPF record as spam and reject them.<\/p>\n
Finally, all of these may be used together for relatively complex authorizations.<\/p>\n
v=spf1 ip4:192.168.0.0\/16 a:example.com include:_spf.google.com<\/pre>\n
Remember, SPF records help the receiving email servers<\/a> identify authentic email messages from your company’s domain.<\/p>\n
DKIM Keys<\/h3>\n
DKIM protects your domain and helps to prevent anyone from impersonating your company. The two DKiM keys allow the recipient’s email server to verify that your company sent the message and that it was not altered after you sent it.<\/p>\n
The first step in setting up DKIM is generating the keys \u2014 one public and one private. The private key is secure on the server used for sending emails from your domain. The public key is added to the DNS as a TXT record.<\/p>\n
The tricky part is generating the keys since the exact procedure for creating them varies from one email service provider to the next. And it is completely different if your company hosts its own mail server.<\/p>\n
Email service providers offer instructions. Here are several examples in no particular order.<\/p>\n