The Spoofing Problem
Over 90% of cyberattacks start with email. If criminals can send as ceo@yourdomain.com, they can authorize wire transfers or steal credentials. SPF + DKIM + DMARC closes that door.
SPF (Sender Policy Framework)
Declares which IPs may send mail for your domain. Example TXT: v=spf1 include:_spf.google.com ~all. Mechanisms: ip4, ip6, a, mx, include. Qualifiers: +pass, -fail, ~softfail, ?neutral.
DKIM (DomainKeys Identified Mail)
Adds cryptographic signature in mail headers. Public key published as TXT default._domainkey.yourdomain.com. Use 2048-bit keys; rotate yearly via dual-key method to avoid delivery hiccups.
DMARC (Domain-based Message Authentication)
Tells receivers to quarantine or reject non-aligned mail and sends you XML reports. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Gradually move to p=quarantine then p=reject.
Alignment Modes
SPF alignment: envelope-from matches header-from domain. DKIM alignment: d= field matches header-from. DMARC requires either SPF or DKIM to align—relaxed mode allows subdomains, strict requires exact match.
Implementation Steps
- Create SPF covering all mail sources (include SendGrid, CRM, office static IP)
- Enable DKIM in Google Workspace, copy TXT record to DNS
- Add DMARC TXT at root with rua tag for reports
- Wait 48 h, analyze XML, adjust SPF includes
- Raise policy to quarantine at 25% traffic, then 100%
Report Analysis
Services like Dmarcian or Postmark parse daily XML and show graphs of aligned vs failed mail. Sudden spike from unknown IP may indicate phishing campaign using your domain.
Common Mistakes
- More than 10 DNS lookups in SPF → permerror, use flattening tools
- Forgetting marketing SaaS in SPF → legitimate mail fails
- DKIM key too short (512-bit) → rejected by Gmail
Third-Party Senders
Add each service to SPF and DKIM. Use subdomains (newsletter.yourdomain.com) to isolate reputations—if Mailchimp gets blacklisted, main domain stays clean.
Final Milestone
Once DMARC reaches p=reject with <0.1% legitimate fail rate, add rua=mailto:forensic@yourdomain.com for forensic reports. You’ve achieved enterprise-grade email authentication.