Configure SPF, DKIM and DMARC
Add provider-approved DNS records to authenticate email, protect the domain and improve delivery from Wemblo-connected senders.
Overview
Search Aliases: authenticate email domain, SPF TXT, DKIM selector, DMARC TXT
MAIN CONCEPTS
| SPF | DNS record listing systems authorized to send for the domain. |
|---|---|
| DKIM | Cryptographic signature validated through a public DNS key. |
| DMARC | Policy and reporting based on SPF/DKIM alignment. |
| DNS Host / Name | Record label. |
| DNS Value | Provider-supplied record content. |
| Selector | DKIM record identifier. |
SPF PROCESS
- Obtain the provider's SPF requirement.
- Review the domain's existing SPF record.
- Do not create several conflicting SPF records.
- Merge authorized senders according to the domain/provider plan.
- Save the TXT record.
- Verify with the provider.
DKIM PROCESS
- Open the provider's domain-authentication or email-security area.
- Generate or copy the DKIM record and selector.
- Add the supplied TXT or CNAME record in DNS.
- Wait for propagation.
- Return to the provider.
- Enable or verify DKIM signing.
- Send a test and inspect authentication results.
DMARC PROCESS
- Choose a reporting mailbox controlled by the business.
- Start with a monitoring policy when appropriate.
- Add the DMARC TXT record at _dmarc for the domain.
- Review reports.
- Increase enforcement only after valid senders are authenticated.
- Keep the policy aligned with the business's email-security plan.
GOOGLE WORKSPACE NOTE
Google's current guidance describes generating a DKIM key, adding the public key to DNS, then turning on and verifying DKIM. Follow the current Google Workspace interface and official documentation when Google is the sender.
COMMON ISSUES & SOLUTIONS
| Several SPF records | Consolidate into one valid policy. |
|---|---|
| DKIM stays unverified | Check selector, record type, hostname and propagation. |
| DMARC blocks legitimate mail | Confirm SPF/DKIM alignment and all approved senders. |
| Authentication passes provider but not recipient | Review From domain, forwarding and message modification. |
Official links
Google DKIM: https://knowledge.workspace.google.com/admin/security/set-up-dkim
Google DMARC: https://knowledge.workspace.google.com/admin/security/set-up-dmarc
Last reviewed: