implementing-dmarc-dkim-spf-email-security

Start by auditing existing records with dig TXT queries, then publish an SPF record listing authorized senders ending in -all, generate a 2048-bit DKIM key pair with OpenSSL and publish the public key in DNS, and finally add a DMARC record at _dmarc.example.com beginning with p=none for monitoring.

Deploy SPF first to authorize sending IPs, then DKIM to cryptographically sign outgoing mail, and finally DMARC which builds on both. DMARC should start at p=none for monitoring, progress to quarantine, and end at reject once legitimate sources align.

DMARC fails when the authenticated domain does not align with the From header domain, even if SPF or DKIM individually pass. Verify the adkim and aspf alignment settings rather than just checking pass/fail results in the Authentication-Results header.

SPF permerror occurs when the record exceeds 10 DNS lookups, typically from too many include mechanisms. Flatten includes where possible, inventory all legitimate sending sources, and end the record with -all for a hard fail.

Use 2048-bit RSA keys for DKIM, as 1024-bit or shorter keys are deprecated. Assign a unique selector per sending service and rotate keys annually to maintain security.

Add the sp=reject tag to your DMARC record to apply the policy to subdomains. Without it, attackers can spoof addresses like noreply.example.com even when the organizational domain is locked down with p=reject.