Setting up SPF and DMARC
Declare which servers may send email for your domain, and what recipients should do with email that fails.
Together with DKIM, SPF and DMARC make sure nobody can simply send email in the name of your domain. They also help your own email reach the inbox.
SPF: who may send?
An SPF record is a TXT record on @ listing the servers allowed to send email for your domain.
| Situation | SPF record |
|---|---|
| Only email via Knippin web hosting | v=spf1 mx a -all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| Google Workspace | v=spf1 include:_spf.google.com -all |
| Knippin web hosting and a newsletter service | v=spf1 mx a include:<service-address> -all |
Rules:
- There may be only one SPF record per domain. Add extra senders to the same record.
-allat the end means: all other servers are not allowed. With~all, a mismatch is only a soft warning, which is handy while testing.- Use no more than 10
includeparts. Otherwise recipients reject the record.
DMARC: what should a recipient do with fake email?
DMARC is a TXT record with the name _dmarc. It tells recipients what to do with email that fails SPF or DKIM. It also asks for reports.
Start by only measuring:
| Name | Type | Value |
|---|---|---|
_dmarc |
TXT | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
Review the reports for a few weeks. Is all your genuine email passing? Then tighten the policy to p=quarantine (suspicious mail to spam) and later to p=reject (refuse).
Setting it up in the customer panel
Go to Services → Domains, click the domain and choose Manage DNS records. Add the TXT records as shown above. See also Managing DNS records.
A detailed guide with a real-world test is available at Knippin University: Setting up SPF, DKIM and DMARC.