Question 1

What is SPF?

Accepted Answer

Sender Policy Framework (SPF) allows a domain owner to publish in DNS which mail servers are authorised to send email on behalf of that domain. Recipient servers can check whether the sending server is listed. If it is not, the message may be treated as suspicious.

Question 2

What is DKIM?

Accepted Answer

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outbound email. Recipients can verify that the email came from the authorised sending system and that the signed portions of the message were not altered in transit.

Question 3

What is DMARC?

Accepted Answer

Domain-based Message Authentication, Reporting and Conformance (DMARC) builds on SPF and DKIM. It allows domain owners to set a policy for messages that fail authentication, receive aggregate reports on who is sending as their domain, and progressively move toward enforcement.

Question 4

Should DMARC be set to reject immediately?

Accepted Answer

No. Setting p=reject before identifying all legitimate senders can block legitimate email — including invoices, HR systems and CRM notifications. The correct approach is to start with p=none and aggregate reporting, identify and fix all legitimate sending, and then move toward quarantine and reject gradually.

Question 5

Can I have more than one SPF record for my domain?

Accepted Answer

No. Publishing two SPF records for the same hostname is an error that causes both to be ignored. Only one SPF record should exist per hostname. All authorised senders must be combined into a single record.

Email Authentication & Sending Architecture Review

What This Review Covers

From the Blog