Domain Authentication Using SPF, DKIM and DMARC

Authentication changes affect every email your organisation sends, so they must be made carefully and in the right order. We first document existing DNS records at your domain registrar or DNS provider, so any change can be reversed if needed. SPF is then consolidated into a single record, since multiple SPF records cause failures, listing each legitimate sending service through its recommended include statements. We check the total number of DNS lookups, because SPF has a limit of ten, and exceeding it causes authentication to fail silently; where necessary, we simplify the record or move some sending services to subdomains. DKIM is enabled in each platform that supports it, generating key pairs and publishing the public keys as DNS records with the selectors each platform requires, using adequate key lengths. We verify that each service signs with your domain rather than a shared platform domain, which is essential for DMARC alignment. DMARC is introduced gradually. We begin with a monitoring policy that requests reports without affecting delivery, collect and review the aggregate reports for several weeks to confirm that all legitimate sources pass SPF or DKIM with alignment, fix any services that fail, and then move step by step to a quarantine policy and, where appropriate, a reject policy, sometimes applying enforcement to a percentage of mail first. This staged approach protects legitimate email while progressively blocking spoofing. Subdomain policies are considered, as attackers sometimes target unused subdomains. Domains that never send email, such as parked or secondary domains, receive records declaring that no mail should be accepted from them. For organisations that want their logo displayed beside authenticated emails in supported inboxes, we can advise on BIMI requirements, which include an enforced DMARC policy and, for some providers, a verified mark certificate with associated costs.