Why three protocols?
Email was designed in 1982 to be permissive — any server could claim to be sending mail on behalf of any domain. SPF, DKIM, and DMARC are three layered patches that, together, let receiving mail servers verify that an inbound message is genuinely authorized by the domain it claims to be from.
- SPF answers "which IPs are allowed to send mail as
example.com?" - DKIM answers "was this message actually signed by
example.com's mail server?" - DMARC answers "what should happen if either of the above fails?"
Step 1 — Publish SPF
SPF is a TXT record at the apex of your domain. It lists the hosts allowed to send mail on your behalf. You'll typically include your transactional provider and your Workspace.
The ~all at the end is a soft-fail — receivers will mark rather than reject mail from non-listed senders. Once you trust your config, escalate to -all.
Step 2 — Set up DKIM
DKIM signs each outbound message with a cryptographic key. The public half of that key lives in DNS under a per-provider selector.
Step 3 — Activate DMARC
DMARC ties SPF and DKIM together and tells the world what to do when one of them fails. Start with p=none and just collect reports for two weeks before tightening.
Verify it all worked
Run a lookup on DNSfish — the result page will show inline badges next to each TXT confirming SPF parsed, DKIM published, and DMARC active. Then send yourself a test message and check the headers for spf=pass and dkim=pass.