SPF, DKIM, and DMARC are complementary controls. Deploying only one leaves gaps in spoofing protection and mailbox trust.
SPF: who can send mail for your domain
SPF authorizes approved senders in DNS. Keep records concise, remove stale vendors, and avoid multiple SPF records at the same host.
DKIM: cryptographic message signing
DKIM validates that message headers/body were signed by an authorized sender and were not altered in transit.
DMARC: policy and reporting layer
DMARC checks alignment and tells receivers what to do for failures (`none`, `quarantine`, `reject`) while sending aggregate reports.
Common implementation mistakes
Frequent issues include missing alignment, old third-party senders, and moving to enforcement before all legitimate send paths are validated.
Safe rollout pattern
Start at `p=none`, review reports, fix alignment gaps, then progressively enforce. Use staged policy increases to avoid legitimate mail loss.
Operational best practices
Track every sending platform, rotate DKIM keys on schedule, and review DMARC reports regularly to catch drift and unauthorized use.