SPF, DKIM and DMARC: make sure your mail arrives

Large mail providers such as Gmail or Outlook hardly accept mail without SPF, DKIM and DMARC anymore. The three records prove that a message really comes from your domain, whether you use Google, Microsoft or your own mail server.

What the three records do

Record	Question it answers
SPF	Which servers may send mail for my domain?
DKIM	Was the message changed on the way? (signature)
DMARC	What should the recipient do if SPF or DKIM do not match?

The quick way

If your domain uses the TryNxt name servers, open it, go to the Connect tab and choose the E-mail tile. Pick your provider: Google, Microsoft or your own mail server. We set MX, SPF and DMARC. Existing SPF and DMARC records are replaced, not duplicated. Duplicate SPF records are a common mistake that breaks delivery.

You still add DKIM yourself afterwards, see below.

SPF by hand

An SPF record is a TXT record on the domain itself (@). For your own mail server listed in the MX:

example.com.  TXT  "v=spf1 mx -all"

-all means: everything else is not allowed. If you also use a newsletter service, its include: goes in front, as the service describes.

There may only be one SPF record per domain. Several services go into the same record.

DKIM

Your mail provider creates the DKIM key. It gives you a name (the "selector") and a long value. Enter both in the DNS records tab as a TXT record:

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

DMARC

Start with a mild policy and read the reports:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Once no more errors come in, switch to p=quarantine and later to p=reject.

Your own mail server on the VPS

In addition to the three records, your mail server needs a matching reverse DNS: the IP address must point to the server's name, such as mail.example.com, and the name must point back to the address via an A or AAAA record. You set reverse DNS in your server's Network tab.

Check

Our free DNS & mail check shows SPF, DKIM (with selector), DMARC and DNSSEC at a glance. The blacklist check tells you whether your server IP is on a blocklist.