SPF, DKIM, and DMARC are complementary controls. Deploying only one leaves gaps in spoofing protection and mailbox trust.
SPF: who can send mail for your domain
SPF authorizes approved senders in DNS. Keep records concise, remove stale vendors, and avoid multiple SPF records at the same host.
DKIM: cryptographic message signing
DKIM validates that message headers/body were signed by an authorized sender and were not altered in transit.
DMARC: policy and reporting layer
DMARC checks alignment and tells receivers what to do for failures (`none`, `quarantine`, `reject`) while sending aggregate reports.
Common implementation mistakes
Frequent issues include missing alignment, old third-party senders, and moving to enforcement before all legitimate send paths are validated.
Safe rollout pattern
Start at `p=none`, review reports, fix alignment gaps, then progressively enforce. Use staged policy increases to avoid legitimate mail loss.
Operational best practices
Track every sending platform, rotate DKIM keys on schedule, and review DMARC reports regularly to catch drift and unauthorized use.
What to do once reports arrive
Receiving reports is the start, not the end. Three things we do for you in DomainGuard so the reports turn into action:
- We rank the senders in the report by failing-message volume. Unknown IPs with material failure show up first because that is the “we forgot a service” case, which is what breaks enforcement if you do not catch it.
- We tell you when it is safe to advance from
p=nonetop=quarantine. The rule is at least two weeks of reports and 95% of mail passing SPF or DKIM. We surface that as a banner the day it becomes true, not a chart you have to interpret. - When your email starts landing in spam, we tell you which sender is failing and how to fix it. The diagnostic panel runs the per-domain data through a checklist of failure modes — missing DMARC record, broken DMARC record, unrecognised sender, misconfigured ESP — and ranks the most likely cause first.