SPF, DKIM and DMARC: a rollout checklist that protects legitimate mail

1. Build a sender inventory

List every system allowed to send using your visible From domain: employee mail, forms, receipts, support, CRM, newsletters, monitoring and vendors. Include rarely used systems such as billing reminders and password resets.

Capture the envelope-from domain, DKIM signing domain, provider owner and a test contact for each source. This prevents a policy change from silently blocking a small but important mail stream.

• Every sending service has an owner
• Transactional and marketing streams are included
• Forwarding and mailing-list paths are identified
• A test message can be generated from each source

2. Make SPF precise and maintainable

SPF authorizes hosts for the SMTP identity, not the human-visible From address by itself. Publish a single SPF TXT record for each domain and merge providers deliberately. Multiple SPF records cause a permanent evaluation error.

Review include chains and the protocol processing limit. Remove retired services instead of accumulating authorizations forever. A message can still pass DMARC through aligned DKIM when SPF does not align, so do not treat SPF as the entire solution.

3. Use aligned DKIM signatures

DKIM signs selected message headers and body content. The receiver retrieves a public key from DNS and verifies that a responsible signing domain created an intact signature. For DMARC, the signing domain must align with the visible From domain.

Enable DKIM in every provider, prefer modern key sizes offered by that provider, document selectors and rotate keys without deleting the old public key before queued mail has cleared. Send a real message and inspect Authentication-Results rather than trusting a setup screen alone.

4. Observe DMARC before enforcement

Publish a valid DMARC record at the _dmarc label and send aggregate reports to a monitored mailbox or reporting service. Monitoring mode lets you discover forgotten senders and alignment failures while receivers continue normal disposition.

Group reports by source and volume. Investigate unknown high-volume sources, but distinguish abuse from a legitimate vendor using an unaligned identity. Fix the sender rather than permanently weakening policy.

• Aggregate reports are arriving
• Known sources pass through SPF or DKIM alignment
• Unknown sources are investigated
• Forwarding behavior is understood

5. Increase policy with rollback evidence

When legitimate traffic is consistently aligned, advance policy in measured steps. Record the previous record, change time, expected effect and rollback owner. Watch delivery telemetry and reports after every change.

Authentication proves domain authorization and message integrity signals; it does not prove that content is safe or wanted. Reputation, complaint rates, list hygiene and secure account access still affect deliverability.