We're writing this article to remind you that due to changes introduced by Google from February 1st for email senders, you must set up SPF and DKIM records for your domain so that your emails don't end up in spam or get rejected by receiving servers.
SPF and DKIM are the first of two steps you need to complete. The next one is setting up the DMARC record. But let's go step by step.
As a reminder, SPF and DKIM records are authentication records that tell recipient servers that you are who you say you are and that the sending server is authorized to send messages on behalf of your domain.
If you're not sure what this means, first read our article About SPF and DKIM settings for your mail server, and then come back to this article.
Because in addition to configuring SPF and DKIM, you also need to set up a DMARC record (another authentication record), and you should do it by the end of March so that your emails don't end up in spam starting April 1st (when Google's policy becomes stricter).
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication, policy, and reporting protocol that helps protect against phishing attacks and other online fraud.
It allows the email recipient to verify whether the message received is authentic. DMARC policy also allows you to specify what happens to an email if it fails authentication (it can be directed to spam or rejected).
For the DMARC protocol to work correctly, you must first configure SPF and DKIM records for your domain, as DMARC is a complementary solution that extends their functionality. Wait 48 hours after setting up SPF and DKIM before configuring DMARC.
Because it tells the incoming mail server whether a message that failed SPF and DKIM verification should be accepted or rejected, and whether a report should be generated for such an event and sent to a specified email address. This helps improve your domain's security and better control email messages.
The DMARC record checks whether the domain used in the Header/From field (sender's email) is actually the sender of the message. It compares it with the domain(s) found in the SPF or DKIM record.
To ensure these domains are aligned, the domain used to generate the DKIM signature must match the domain in the Header/From field, while SPF should confirm that the IP address of the sending server was authorized by the owner of the domain specified in the SMTP MailFrom command.
The entire process, in simplified terms, works something like this:
If the email fails authentication, what happens to it depends on the sender domain's DMARC policy.
You define the DMARC record (Domain-based Message Authentication, Reporting, and Conformance) by adding the appropriate entry in your domain's DNS settings.
Before you start adding the DMARC record, prepare a text file or line containing the policy record.
A DMARC record consists of plain text containing a list of DMARC tags and values separated by semicolons. Some tags are required, others are optional.
DMARC policies inform receiving servers what actions to take with unauthenticated messages from your domain. These actions are recorded in the policy tag (p).
Below is an example of a DMARC record. Note:
v=DMARC1; p=reject; rua=mailto:master@yourcompany.com, mailto:dmarc@yourcompany.com; pct=100; adkim=s; aspf=sYou can find the DMARC record tags in this article.
We recommend starting DMARC deployment by setting p=none policy. This means you'll receive reports without the risk of receiving servers sending your messages to spam or rejecting them.
In the next step you can change the configuration to a policy where all unauthenticated messages are rejected.
Once you have the DMARC record text prepared, add or update the TXT DNS record at your domain registrar.
Log in to your domain hosting provider's management console and follow the steps below.
To better show you where to enter what, we used an example domain (yourcompany.com). Replace this domain with your own.
1. Go to the page for updating DNS records to add or modify the current TXT DNS record
2. In the first field, enter the "TXT record name". Below the DNS Host Name text, enter: _dmarc.yourcompany.com
Note that some providers automatically append the domain name after _dmarc. Check the TXT record name for DMARC to make sure it's correctly formatted.
3. In the second field, enter the "TXT record value". Enter the DMARC record text. An example might look like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com
IMPORTANT: Keep in mind that field names may differ between providers, so there may be slight differences in how the TXT DNS record fields are named.
4. Save the changes
Remember! Every time you change the DMARC policy and update the record, be sure to also update the TXT DNS record at your domain registrar.
IMPORTANT: If you have more than 1 domain, prepare a DMARC record with policies for each domain. If you don't, each subdomain will inherit the parent domain's policies. To define DMARC policies for subdomains, use the sp policy tag in the parent domain's DMARC record.