SPF defines authorised sending routes.
An SPF record identifies systems permitted to send email for a domain. Receiving servers can compare the technical sending source with that policy. Newsletter platforms, scanners, cloud applications and forgotten mail servers must all be accounted for.
DKIM protects message integrity.
DKIM adds a cryptographic signature to outgoing email. A receiving server uses the public key published in DNS to check that signed parts of the message were not altered and that the signature belongs to the domain.
DKIM does not replace SPF; the two methods examine different properties of mail delivery.
DMARC connects authentication and policy.
DMARC checks whether the visible sender domain aligns with a successful SPF or DKIM result. The domain owner can also publish a handling policy and request reports about legitimate and unexpected senders.
Do not begin with the strictest policy.
Move to rejection only after legitimate sending sources are known and correctly aligned. Otherwise, genuine messages can be blocked. Managed email security treats DNS, mail flow and later changes as one process.
Alignment is the key DMARC concept.
A technically valid result is not enough: it must match the domain visible to the recipient. This prevents an unrelated authenticated domain from legitimising a forged visible sender.
Observe reports first.
DMARC reports reveal forgotten newsletter tools, multifunction devices and business applications. Use a monitoring phase to identify legitimate sources before enforcing a stricter policy.
Do not overlook subdomains.
Newsletter and system-message subdomains may require their own rules or inherit the main-domain policy. Inventory every domain actually used to send mail and document its purpose.
Make changes through a controlled process.
A new cloud service should not start sending mail without considering existing authentication. Clarify the required DNS records, DKIM keys and sender domains before go-live.