SPF, DKIM, and DMARC: The Complete Guide to Email Authentication

Email authentication is the foundation of email security. Without SPF, DKIM, and DMARC, anyone can send emails that appear to come from your domain — opening the door to phishing, spoofing, and brand impersonation. Here's everything you need to know.

SPF (Sender Policy Framework)

SPF is a DNS record that lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from @yourdomain.com, it checks your SPF record to verify the sending server is authorized.

How to configure SPF

Add a TXT record to your domain's DNS:

v=spf1 include:_spf.smtpy.fr ~all

The ~all means "soft fail" — emails from unauthorized servers are marked suspicious but not rejected. Use -all for strict rejection once you're confident in your setup.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to each email. The receiving server can verify the signature using a public key published in your DNS. This proves the email wasn't modified in transit and genuinely came from an authorized sender.

How to configure DKIM

SMTPy automatically generates a DKIM key pair for your domain. You'll receive a TXT record to add:

smtpy._domainkey.yourdomain.com → v=DKIM1; k=rsa; p=MIIBIjAN...

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together. It tells receiving servers what to do when an email fails authentication — and sends you reports about authentication failures.

How to configure DMARC

_dmarc.yourdomain.com → v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

• p=none: monitor only (no action taken)
• p=quarantine: send failing emails to spam
• p=reject: reject failing emails outright

Start with p=none to collect reports without affecting deliverability, then gradually move to quarantine and reject as you gain confidence.

Verifying your configuration

SMTPy's domain dashboard shows the status of each DNS record in real time. You can also use tools like MXToolbox or dmarcian to validate your setup.

Conclusion

SPF, DKIM, and DMARC are not optional — they're the baseline for any domain used to send email. SMTPy configures all three automatically when you add a domain, making it easy to get it right from the start.