DKIM, SPF, and DMARC are the core controls that protect your domain from spoofing and improve trust in mailbox filtering systems.

You need all three configured correctly for a durable email security posture.

If you need the broader operating model around access control, sender inventory, transport security, and release checks, read [Email security best practices](/guides/email-security-best-practices/).

## What each control does

| Control | Primary purpose                                                                 |
| ------- | ------------------------------------------------------------------------------- |
| SPF     | Declares which sending hosts are allowed for your domain                        |
| DKIM    | Adds cryptographic signatures to prove message integrity and domain association |
| DMARC   | Defines policy and reporting based on SPF/DKIM alignment outcomes               |

## How they work together

1. Receiver checks SPF host authorization.
2. Receiver validates DKIM signatures.
3. Receiver applies DMARC policy based on alignment/pass results.
4. Receiver may send aggregate/forensic reports (where configured).

DMARC is the policy layer; SPF and DKIM are the underlying signals.

## Rollout strategy that reduces risk

### Phase 1: Visibility

- Publish SPF and DKIM for all sending systems.
- Publish DMARC with `p=none`.
- Collect and review DMARC aggregate reports.

### Phase 2: Tightening

- Fix unknown senders and alignment issues.
- Remove stale SPF includes and rotate weak DKIM keys.
- Increase policy confidence using report data.

### Phase 3: Enforcement

- Move DMARC to `quarantine`, then `reject` when stable.
- Keep monitoring and change control in place.

## Example DNS records

SPF:

```txt
v=spf1 include:_spf.example-provider.com -all
```

DKIM (selector example):

```txt
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..."
```

DMARC:

```txt
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1
```

## Common misconfigurations

- multiple conflicting SPF records,
- SPF include chains exceeding DNS lookup limits,
- DKIM selectors not rotated or missing for one sender path,
- DMARC enforcement before all send streams are aligned.

## Monitoring checklist

1. Track DMARC pass/fail rates by source.
2. Alert on new unrecognized sender infrastructure.
3. Review DKIM key age and rotation cadence.
4. Audit SPF records after provider or infra changes.
5. Re-test after domain onboarding/migration events.

## Related routes

- [Email security best practices](/guides/email-security-best-practices/)
- [SPF records explained](/blog/spf-records-explained-what-are-they/)
- [What are DKIM records?](/guides/what-are-dkim-records/)
- [DMARC explained](/guides/dmarc-explained/)
- [How to create a BIMI record](/blog/how-to-create-bimi-record/)

## Final take

Email authentication is an operational discipline, not a one-time DNS task. The teams that win keep sender inventory, policy rollout, and report analysis in one repeatable workflow.