Back to Guides
Advanced20 min read

Advanced Email Authentication: DKIM, SPF, and DMARC

Technical guide to implementing email authentication protocols to improve deliverability and prevent spoofing.

Email authentication protocols are no longer optional. As of 2024, Google and Microsoft require proper SPF, DKIM, and DMARC configuration for bulk senders. This guide covers technical implementation for each protocol.

2024/2025 Requirements

Gmail and Outlook now require authentication for senders exceeding 5,000 emails per day. Without proper SPF, DKIM, and DMARC, your emails will be rejected or filtered to spam.

SPF (Sender Policy Framework)

SPF is a DNS record that specifies which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks the SPF record to verify the sender's IP address is authorized.

How SPF Works

  1. 1. You publish an SPF record in your domain's DNS
  2. 2. Someone sends an email claiming to be from your domain
  3. 3. The receiving server checks your SPF record
  4. 4. If the sender's IP is authorized, SPF passes; otherwise, it fails

Creating an SPF Record

SPF records are TXT records added to your DNS. Basic syntax:

v=spf1 include:_spf.google.com ~all

Breaking down this example:

  • v=spf1 - SPF version 1
  • include:_spf.google.com - Include Google's mail servers
  • ~all - Soft fail for all other servers

SPF Mechanisms

ip4:192.0.2.0/24Authorize specific IPv4 addresses
include:domain.comInclude another domain's SPF
aAuthorize domain's A record IPs
mxAuthorize domain's MX record IPs
-all / ~all / +allFail / Soft fail / Pass all others

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails using public-key cryptography. This proves the email hasn't been altered in transit and confirms it came from your domain.

How DKIM Works

  1. 1. Generate a private/public key pair
  2. 2. Publish the public key in DNS
  3. 3. Your mail server signs outgoing emails with the private key
  4. 4. Receiving servers verify the signature using your public key

Generating DKIM Keys

Most email service providers (ESPs) generate DKIM keys automatically. If you're managing your own mail server:

# Generate 2048-bit RSA key pair openssl genrsa -out dkim_private.pem 2048 openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

Publishing DKIM Records

DKIM records are TXT records with a specific selector:

default._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

DMARC (Domain-based Message Authentication)

DMARC builds on SPF and DKIM, telling receiving servers what to do when authentication fails. It also provides reporting so you can monitor authentication issues.

DMARC Policies

p=none (Monitor Mode)

Don't take action on failures, just send reports. Use this when first implementing DMARC.

p=quarantine

Send failed messages to spam/junk folder. Recommended for most domains.

p=reject

Reject failed messages entirely. Only use after monitoring shows no legitimate failures.

Creating a DMARC Record

_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100"

Breaking it down:

  • v=DMARC1 - DMARC version
  • p=quarantine - Policy for failed auth
  • rua=mailto:... - Where to send aggregate reports
  • pct=100 - Apply policy to 100% of messages

Implementation Roadmap

1

Set up SPF

Start with SPF as it's the simplest. Include all legitimate sending sources.

2

Implement DKIM

Generate keys and add signing to your mail server or ESP.

3

Add DMARC in monitor mode

Start with p=none to collect data without blocking emails.

4

Review DMARC reports

Analyze reports for 2-4 weeks to identify issues.

5

Gradually increase policy

Move from p=none to p=quarantine, then eventually p=reject.

Testing Your Configuration

Use these tools to verify your authentication setup:

  • MXToolbox: Check SPF, DKIM, and DMARC records
  • Mail-tester.com: Send a test email and get a score
  • Google Postmaster Tools: Monitor domain reputation
  • DMARC Analyzer: Parse and analyze DMARC reports

Combine Authentication with Validation

Email authentication prevents spoofing, but you still need validation to ensure addresses are deliverable. HeroBounce validates emails before they enter your system.