Web
SPF, DKIM and DMARC
Set up SPF, DKIM and DMARC properly – so your mail is delivered and nobody sends spam in your name.
- SPFpermitted senders
- DKIMsignature of the mail
- DMARCpolicy and reporting
Why your mail ends up in spam
Spammers send messages with forged sender addresses – often using other people's domains. As a result domains end up on blacklists and legitimate mail is blocked or classified as spam.
Three DNS records create clarity: SPF defines which servers may send for your domain. DKIM signs every message cryptographically. DMARC tells recipients how to handle failed checks – and provides reports.
| Record | Function | Example |
|---|---|---|
| SPF | Lists authorised mail servers | v=spf1 mx a include:_spf.google.com ~all |
| DKIM | Signs outgoing mail | TXT record with public key |
| DMARC | Sets policy and reporting | v=DMARC1; p=quarantine; rua=mailto:dmarc@domain.com |
Step-by-step introduction
We start with DMARC in monitoring mode (p=none) and evaluate the reports. This reveals which services actually send in your name – such as newsletter tools or CRM systems. Only when all legitimate sources are captured is the policy tightened.
What we check
- Existing SPF and DKIM records
- Number of DNS lookups (mind the limit)
- Forwarding and mailing lists
- Reporting address and evaluation
- Interaction with the mail server
This prevents legitimate mail from being blocked by an overly strict policy.
Monitoring
Being able to read DMARC reports
The raw reports are technical. We set up understandable evaluation and report anomalies.
Ask us directly
Do you have questions about this topic? We are happy to advise you personally.
Get in touch +49 212 380858-30Mon–Fri 9–17 · 24/7 emergency
Related services
Email authentication
Mail that gets delivered.
We check your DNS records and set up SPF, DKIM and DMARC properly.