SPF, DKIM, and DMARC, explained the way we'd explain it over email
This page isn't trying to sell you anything — it's the plain-language version of what we actually do, so you can follow along or sanity-check us.
SPF — who's allowed to send
SPF (Sender Policy Framework) is a DNS TXT record listing the mail servers authorized to send email as your domain. A receiving server checks the sending IP against that list before it decides how much to trust the message.
The record has a real, hard limit worth knowing about: it can't require more than 10 DNS lookups to evaluate (RFC 7208). Every third-party sender you add — your email platform, your marketing tool, your helpdesk — usually costs at least one. Domains that have accumulated a lot of "include:" entries over the years can quietly blow past that limit, which breaks SPF entirely, for every sender, not just the newest one.
example.com. 3600 IN TXT "v=spf1 include:_spf.example-esp.com include:mail.example-crm.com -all"DKIM — proof the message wasn't touched
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail. The receiving server looks up a public key published in your DNS and checks the signature against it. If it matches, the message provably came from a server holding your private key and wasn't altered in transit.
DKIM lives at a DNS name specific to whichever service is sending the mail — a "selector" — which is why it can't be checked generically the way SPF and DMARC can. That's part of what a full audit does by hand: finding every selector actually in use, not just the obvious one.
Why SPF or DKIM alone isn't enough
Either one can pass while the message still isn't trustworthy — SPF passes for anything sent through an authorized server regardless of who asked it to, and DKIM only proves the signed content wasn't altered, not who requested the signature. DMARC is the layer that ties the visible "From" address to one of those checks actually passing, which is what closes the gap.
DMARC — the policy, and the staged rollout to get there
DMARC ties everything together: it requires SPF or DKIM to both pass and line up with the domain in the visible "From" address, tells receivers what to do when that fails, and reports back on who's sending mail as your domain. The rollout is staged on purpose — going straight to full enforcement is the single most common way legitimate mail gets blocked by accident.
-
Stage 1
Monitor p=none
v=DMARC1; p=none; rua=mailto:reports@yourdomain.comNothing changes about how mail is delivered. This just turns on reporting, so you can see every server sending mail as your domain — including ones you forgot about, like an old marketing tool or a form-notification service.
-
Stage 2
Quarantine p=quarantine
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.comOnce the reports from Stage 1 confirm every legitimate sender is passing, mail that fails DMARC starts getting treated as suspicious — typically routed to spam rather than the inbox. This is real protection, and for a lot of domains, it turns out to be the right place to stay.
-
Stage 3
Enforcement — the target depends on the domain
This is the step that changed. DMARC's core specification was rewritten in May 2026 (RFC 9989, replacing the 2015 original), and it's explicit that domains with real people sending mail from them shouldn't deploy p=reject — receivers are now instructed to treat a "reject" policy as "quarantine" anyway unless they have other reasons to trust it. The reasoning: a person forwarding a message to a mailing list can fail SPF and DKIM through no fault of their own, and full rejection punishes that the same as an actual spoofing attempt.
In practice, that means: for a domain or subdomain that's purely automated — receipts, notifications, a dedicated marketing sender, nothing a human ever sends from directly — p=reject is still the right, achievable target. For a domain where employees or customers also have real mailboxes, p=quarantine is now the spec's recommended end state, not just a waypoint. We set the target per domain instead of pushing every client to the same finish line — which is exactly the kind of judgment call a self-serve dashboard doesn't make for you.