Understanding SPF, DKIM, and DMARC: A Developer's Guide

Overview

SPF, DKIM and DMARC form the bedrock of modern email authentication. This guide focuses on how they interact and how engineers should implement them.

SPF

SPF declares which IPs are allowed to send mail for a domain. Keep your SPF record short, use include: for third-party vendors, and avoid exceeding DNS lookup limits.

DKIM

DKIM signs outbound messages with a private key; receivers validate the signature using the public key in DNS. Rotate keys and use 2048-bit selectors for better security.

DMARC

DMARC tells receivers what to do with messages failing SPF/DKIM and provides reporting. Start with p=none to collect reports, then move to quarantine or reject as confidence grows.

Combine monitoring and incremental enforcement for safe rollout.