{"id":442,"date":"2020-10-15T17:43:21","date_gmt":"2020-10-15T17:43:21","guid":{"rendered":"https:\/\/dft.wiki\/?p=442"},"modified":"2026-06-09T13:35:15","modified_gmt":"2026-06-09T17:35:15","slug":"sender-framework-policy-spf","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=442","title":{"rendered":"SPF + DKIM + DMARC Overview"},"content":{"rendered":"<p>Tools against SPAM and domain spoofing:<\/p>\n<ul>\n<li><strong>SPF<\/strong> &#8211; Whitelist of hosts allowed to send email on behalf of the organization.<\/li>\n<li><strong>DKIM<\/strong> &#8211; Digital signatures used to verify that a message really came from the organization.<\/li>\n<li><strong>DMARC<\/strong> &#8211; Tells receiver servers what to do with emails that fail SPF and\/or DKIM.<\/li>\n<\/ul>\n<hr \/>\n<p><strong>SPF (Sender Policy Framework)<\/strong> is one more weapon to fight email spam.<\/p>\n<p>The idea is to use DNS records (TXT format) to advertise which sources are legitimately allowed to send email for your domain, reducing the chances of spoofing. See example:<\/p>\n<ul>\n<li>Record name\n<ul>\n<li><strong>(empty) or &#8220;*&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Value\n<ul>\n<li><strong>&#8220;v=spf1 a mx include:mailvendor.com ~all&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Configure your DNS<\/strong> server using TXT records to define the sending rules for your domain:<\/p>\n<ul>\n<li>.         IN         TXT         &#8220;v=spf1 <strong>mx<\/strong>&#8221;\n<ul>\n<li>Only the IP in the MX record is allowed to send emails for this domain.<\/li>\n<\/ul>\n<\/li>\n<li>.         IN         TXT         &#8220;v=spf1 <strong>a<\/strong>&#8221;\n<ul>\n<li>Only IPs with an A record are allowed.<\/li>\n<\/ul>\n<\/li>\n<li>.         IN         TXT         &#8220;v=spf1 <strong>-all<\/strong>&#8221;\n<ul>\n<li>Reject anything that does not comply.<\/li>\n<\/ul>\n<\/li>\n<li>.         IN         TXT         &#8220;v=spf1 <strong>~all<\/strong>&#8221;\n<ul>\n<li>Accept but flag any non-compliant email.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Configure Reverse DNS<\/strong> (rDNS):<\/p>\n<ul>\n<li>If your server is hosted on a VPS (AWS, GCP, Linode, etc.) you can go into your cloud dashboard and set the reverse DNS to your domain or subdomain.<\/li>\n<li>If you own the server, set up a local DNS resolver. BIND9 is a solid choice.<\/li>\n<\/ul>\n<p>Once SPF and rDNS are configured, verify that the records are correct by running the following commands:<\/p>\n<pre>dig +short DOMAIN.COM\r\ndig -x 1.1.1.1 +short<\/pre>\n<p>The first command checks the SPF record in DNS.<\/p>\n<p>The second checks the rDNS.<\/p>\n<p>In this example, <strong>DOMAIN.COM<\/strong> has SPF pointing to <strong>1.1.1.1<\/strong>, so <strong>1.1.1.1<\/strong> should also resolve in reverse to <strong>DOMAIN.COM<\/strong>.<\/p>\n<hr \/>\n<p><strong>DKIM (DomainKeys Identified Mail)<\/strong> is an authentication method designed to detect forged senders.<\/p>\n<p>It works by copying the key generated by your outgoing email server into the DNS records using TXT format. See example:<\/p>\n<ul>\n<li>Record name\n<ul>\n<li><strong>itytzkakk._domainkey.<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Value\n<ul>\n<li><strong>&#8220;v=DKIM1; k=rsa; p=4GNADCBiQKBgQCgzjLMIGfMA0GCSqGSIb3DQEBAQUAAo9D2g8sCXXcad9\/S5HAAG7m5yVMnSN5TCaYBDR30YhU\/BAG8o8B93nkMGZwe9FAaUtD+qTMDp2dByA9n1rtPvssQbXUnwgmUD20e1lKOjyi\/Yrbgr4JCNlP+7HTFviRfoMdtzfIBfK8Nkl0JeZ3GvNkQfwIDAQABRDtyuGSdFWtaS&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>DMARC (Domain-based Message Authentication, Reporting &amp; Conformance)<\/strong> defines the policy to apply when SPF and\/or DKIM fail.<\/p>\n<p>It also requires a DNS TXT record. See example:<\/p>\n<ul>\n<li>Record name\n<ul>\n<li><strong>_dmarc.<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Value\n<ul>\n<li><strong>&#8220;v=DMARC1; p=reject; fo=1; pct=100&#8221;<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Syntax breakdown:<\/p>\n<ul>\n<li><strong>v=DMARC1<\/strong>\n<ul>\n<li>DMARC protocol version.<\/li>\n<\/ul>\n<\/li>\n<li><strong>p=reject<\/strong>\n<ul>\n<li>Policy to apply: &#8216;none&#8217;, &#8216;quarantine&#8217;, or &#8216;reject&#8217;.<\/li>\n<\/ul>\n<\/li>\n<li><strong>pct=100<\/strong>\n<ul>\n<li>The percentage of emails the policy applies to.<\/li>\n<\/ul>\n<\/li>\n<li><strong>fo=1<\/strong>\n<ul>\n<li>Forensic reporting option: &#8216;0&#8217; generates reports only if both DKIM and SPF fail; &#8216;1&#8217; generates reports if either fails.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>WEB TOOLS<\/strong><\/p>\n<ul>\n<li>LearnDmarc [<a href=\"https:\/\/www.learndmarc.com\/\">Link<\/a>]<\/li>\n<li>easySPF Wizard [<a href=\"https:\/\/www.spfwizard.com\/\">Link<\/a>]<\/li>\n<li>DMARCreport [<a href=\"https:\/\/app.dmarcreport.com\/\">Link<\/a>]<\/li>\n<li>ValiMail [<a href=\"https:\/\/domain-checker.valimail.com\/dmarc\">Link<\/a>]<\/li>\n<li>PowerDMARC [<a href=\"https:\/\/powerdmarc.com\/analyzer\/\">Link<\/a>]<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Tools against SPAM and domain spoofing: SPF &#8211; Whitelist of hosts allowed to send email [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-442","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=442"}],"version-history":[{"count":10,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/442\/revisions"}],"predecessor-version":[{"id":5821,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/442\/revisions\/5821"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}