SPF, DKIM and DMARC explained for small businesses

Three checks with different jobs

SPF, DKIM and DMARC help receiving mail systems evaluate messages that claim to come from your domain. SPF authorizes sending systems, DKIM verifies a message signature, and DMARC checks alignment with the visible From domain. They work together, but they do not guarantee inbox placement.

Start by listing every service that sends mail for your business. Your team’s mail, transactional application messages and other authorized services may take different paths. Use the exact configuration provided by each service for your own domain.

SPF: which systems may send?

Sender Policy Framework publishes a DNS policy for the domain used in the SMTP envelope sender. A receiver can use that policy to check whether the sending system is authorized. The address people see in the From field is not necessarily the envelope sender.

Maintain one SPF policy at a given hostname, accounting for all authorized senders. Avoid copying a sample IP address from a guide. SPF has limits on DNS lookups, so review the complete policy when combining multiple services.

DKIM: can the signature be verified?

DomainKeys Identified Mail adds a cryptographic signature to a message. The receiving system retrieves a public key from DNS using the signing domain and selector, then checks that the signed parts of the message match the signature.

Use the selector and public key generated for your domain. The private signing key stays with the sending service. A DNS record being present is only part of the check: inspect a real received message to confirm that DKIM verification passes.

DMARC: does authentication align with the From domain?

DMARC evaluates whether a passing SPF or DKIM result aligns with the domain shown in the visible From header. It also lets the domain owner publish a policy and request reports. Alignment is why a passing authentication result for an unrelated domain is not enough.

Inventory legitimate senders and review reports before moving to a restrictive policy. An incorrect policy can affect real business mail. Follow your workspace’s domain instructions and involve the person responsible for DNS when changing enforcement.

Verify results in received mail

Send a test to an account you control and inspect the authentication results recorded by the receiving provider. Check the From domain, SPF result, DKIM signing domain and DMARC alignment. Also test replies, forwarding paths and each separate application that sends for the business.

Mail-server acceptance, authentication success and inbox placement are different signals. Reputation, recipient behavior and provider filtering also matter. RelyPost exposes submission and delivery evidence so you can investigate without treating every accepted request as a delivered message.

Further reading

Consult the SPF specification, DKIM specification and DMARC specification for protocol details.