SPF, DKIM, DMARC Settings: Preventing Email Spam

When it comes to email security, the first three terms that come to mind are SPF, DKIM, and DMARC. These three mechanisms not only prevent your sent emails from landing in the spam folder, but also serve as a shield against phishing attacks. In this article, HostingServer.com.tr walks you through how to configure these records step by step.

What is SPF (Sender Policy Framework)?

SPF is a DNS record that specifies who is allowed to send emails on behalf of a domain. For example, if your domain is hostingfirmasi.com, you only allow the mail servers you specify to send mail on your behalf. A misconfigured SPF record can cause even legitimate emails to be rejected. So care must be taken.

An SPF record is usually added as a TXT record. An example record looks like this:

This record allows your domain's MX servers and Google's mail servers, and marks emails from other sources as “softfail” (likely spam). To give some numbers, a domain without SPF typically has a spam score 5-10 points higher, severely impacting delivery rates.

How Does DKIM (DomainKeys Identified Mail) Work?

DKIM adds a digital signature to your emails. The receiving server verifies this signature using the public key published in your DNS. If the signature is broken (for example, because an intermediate server modified the content), the email is marked as untrustworthy.

To set up DKIM, you first need to generate a private key on your mail server, then add the corresponding public key as a TXT record in DNS. For instance, in cPanel, you can easily create a DKIM record under the “Email Deliverability” section.

Emails without a DKIM signature are 40% more likely to be marked as spam. This data is based on reports from major email providers like Gmail and Outlook.

DMARC (Domain-based Message Authentication, Reporting & Conformance) Policy

DMARC is a policy that determines what to do based on the outcome of SPF and DKIM verifications. There are three policies: none (report only, no action), quarantine (send to spam folder), and reject (outright reject). Starting with “none” is recommended to avoid issues from misconfiguration. Over time, moving to “reject” level boosts your domain's reputation to the highest level.

DMARC Reports

The best feature of DMARC is that it sends you reports. These reports let you see who is sending emails on your behalf and which sources are failing authentication. You can use free tools like dmarcanalyzer.com to process the reports.

A DMARC record is also a TXT record. Example record:

In this example, the policy is set to “quarantine” and reports are sent to the specified address. To set it up step by step, follow this order:

1. First, check or create your SPF record.
2. Generate your DKIM keys and add them to DNS.
3. Start your DMARC policy as “none”, examine the reports, and after 2-3 weeks move to “quarantine” or “reject”.

Common Mistakes and Solutions

• Multiple SPF records: There should be only one SPF record per domain in DNS. Otherwise, you'll encounter errors. Edit your existing record to add entries.
• DKIM selector information: Some providers use a default selector named “default”. When creating your own selector, make sure to add it correctly to DNS.
• DMARC subdomains: Subdomains do not require a separate DMARC record. You can cover subdomains by adding an sp=none policy to the root domain.

Finally, remember: When SPF, DKIM, and DMARC are correctly configured, your email delivery rate can exceed 95%. Incorrect settings have the opposite effect. At HostingServer.com.tr, we always recommend using testing tools: verify your records with tools like Mail Tester or DMARCly.