Sending & authentication guide

Last updated: 15 July 2026

1. SPF — authorize your senders

SPF (Sender Policy Framework) is a DNS TXT record that lists which servers may send mail for your domain. It is evaluated against the envelope MAIL FROM (return-path), not the visible From: header.

v=spf1 ip4:127.0.0.1 ip4:127.0.0.1 -all

2. DKIM — sign every message

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each message. The receiver fetches your public key from DNS to verify the message was not altered and truly came from your domain.

Publish the public key at <selector>._domainkey.yourdomain:

default._domainkey  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

Signing should be the last step before a message is queued for delivery, so that no later processing invalidates the signature.

3. DMARC — tie it together

DMARC tells receivers what to do when SPF or DKIM fail alignment, and where to send reports. Start in monitoring mode and tighten over time.

_dmarc  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain; adkim=r; aspf=r; fo=1"

Progression: p=none → p=quarantine → p=reject. Use our DMARC builder to generate the record.

4. PTR / reverse DNS

Every sending IP should have a PTR record resolving to a hostname that, in turn, resolves back to that same IP (forward-confirmed reverse DNS, or FCrDNS). Many large providers reject or downgrade mail from IPs without valid PTR.

# Verify a PTR record
dig +short -x 127.0.0.1

# Confirm the hostname points back (FCrDNS)
dig +short mail.example.com

5. TLS encryption

Serve a valid certificate on your submission (587) and outbound hosts, and prefer TLS 1.2 or 1.3. Opportunistic TLS protects mail in transit between servers; enforced TLS is available for sensitive routes.

6. Verify your setup

• Run a live DNS lookup to confirm A, MX, and TXT records resolve.
• Send a test message to a seed inbox and inspect the Authentication-Results header for spf=pass, dkim=pass, and dmarc=pass.
• Monitor DMARC aggregate reports for unexpected sources.