Guide · 13 min read
SPF, DKIM and DMARC explained: the complete guide for MSPs
How the three email authentication records fit together, with real examples, alignment explained and a rollout plan that does not break mail.
Email security: SPF, DKIM and DMARC
The records that decide whether a business's email is trusted, delivered and protected from spoofing, explained for MSPs who need to fix them and explain them to clients.
The complete guide
Go deeper
SPF too many DNS lookups · 6 min read
The SPF 10-lookup limit: why adding one more email tool breaks it
Why SPF silently fails after a few include: entries, how to count lookups, and how to fix it without breaking mail.
Google Yahoo sender requirements · 6 min read
Google, Yahoo and Microsoft sender rules, explained for small business owners
The authentication rules the big mailbox providers now enforce, translated into a short checklist for small businesses.
DMARC p=none vs reject · 5 min read
DMARC p=none vs quarantine vs reject, in plain English
What each DMARC policy does to fake email, and a safe path from p=none to p=reject.
MTA-STS setup · 6 min read
MTA-STS in 10 minutes for Microsoft 365 and Google Workspace
Two DNS records and one small text file make other mail servers encrypt email sent to you. Copy-paste setup inside.
find DKIM selector · 6 min read
How to find a domain's DKIM selector (and why you can't list them all)
Three reliable ways to find the selector, the common defaults by provider, and why "DKIM missing" is a claim no outside tool can make.
DMARC aggregate report explained · 7 min read
DMARC aggregate (rua) reports explained, with a worked example
A worked example of one report, what each field means, and how to use the reports to move a domain safely to p=reject.
SPF softfail vs hardfail · 5 min read
SPF ~all vs -all: softfail, hardfail and what DMARC changes
What each SPF ending tells receivers, how DMARC changes the decision, and a simple rule for active and parked domains.
DMARC subdomain policy · 5 min read
DMARC for subdomains: how sp= and policy inheritance work
Which policy applies to mail.example.com, when to set sp=, and how to protect subdomains attackers like to use.
Microsoft 365 DKIM setup · 6 min read
Microsoft 365 DKIM setup: selector1, selector2 and the CNAME records
Step-by-step DKIM for a custom domain in Microsoft 365, how to confirm it is working, and what to do when the portal will not enable it.
Google Workspace DKIM setup · 6 min read
Google Workspace DKIM, SPF and DMARC setup checklist
SPF, DKIM and DMARC for a Google Workspace domain, in the order that avoids broken mail, with how to check each step.