Authenticating domains with SPF and DKIM

Email authentication verifies that emails sent from your domain are legitimate. SPF and DKIM are two protocols that work together to prevent spoofing, protect your brand, and improve deliverability.

Why authenticate your domain¶

Authenticating your domain provides two key benefits:

• Brand protection: SPF and DKIM verify that emails come from authorised servers, making it harder for attackers to impersonate your domain in phishing or spoofing attempts.
• Improved deliverability: mailbox providers use SPF and DKIM to assess incoming emails. Authenticated emails are more likely to reach the inbox instead of being flagged as spam.

SPF¶

SPF (Sender Policy Framework) is an email authentication protocol that lets you specify which mail servers can send email on behalf of your domain. It works by publishing a DNS TXT record in your domain's DNS settings.

How SPF works¶

When you send an email, the receiving server checks your SPF record to confirm the email came from an authorised IP address or hostname. If the sending server matches an entry in the record, the email passes SPF authentication.

The include:spf.mailjet.com directive tells recipient servers that Apteco Email's servers are authorised to send on behalf of your domain. The ~all qualifier at the end means that any server not listed in the record is treated as suspicious, but not outright rejected.

SPF qualifiers¶

The qualifier at the end of your SPF record controls how receiving servers handle unauthorised senders:

Choose a qualifier based on your risk tolerance. SoftFail (~all) is recommended when you're first setting up SPF, as it lets you monitor results before enforcing stricter policies.

Configuring SPF¶

Once Apteco finishes setting up your domain, you'll receive the DNS records you need to add to your domain settings.

To create or update your SPF record:

1. Open your DNS management console.
2. Locate the existing TXT record for your domain, or create a new one.
3. Set the record value to include all authorised sending sources.

v=spf1 include:spf.mailjet.com ~all

v=spf1 include:spf.mailjet.com include:aspmx.pardot.com include:mailgun.org include:spf.protection.outlook.com -all

Merging multiple SPF records¶

If your domain already has an SPF record and you need to add Apteco Email, consolidate both into a single record. Having two separate SPF records for the same domain causes conflicts and authentication failures.

Before merging (incorrect):

v=spf1 include:spf.example1.com ~all
v=spf1 include:spf.mailjet.com ~all

After merging (correct):

v=spf1 include:spf.example1.com include:spf.mailjet.com ~all

DKIM¶

DKIM (DomainKeys Identified Mail) adds a digital signature to your outgoing email messages. The receiving server uses this signature to verify that the email content hasn't been altered in transit, and that it was sent from an authorised domain.

How DKIM works¶

DKIM uses public-private key encryption. When you send an email, Apteco Email signs it with a private key. The recipient's server then verifies the signature using the corresponding public key, which is published as a TXT record in your domain's DNS. If the signatures match, the email is confirmed as legitimate and unaltered.

Configuring DKIM¶

Once Apteco finishes setting up your domain, you'll receive the DNS records you need to add for DKIM.

When adding the record:

• Some domain providers require the entire TXT value to be enclosed in double quotes. If you're unsure, consult your provider's support documentation.
• Some providers automatically append the domain name to the Host field value. Check the Host field after saving to confirm the entry is correct.

DMARC¶

SPF and DKIM verify whether an email comes from a trusted source, but only DMARC (Domain-based Message Authentication, Reporting and Conformance) can enforce policies that prevent spoofed emails from being delivered. Implementing all three protocols provides a comprehensive email authentication framework.

A DMARC record lets you:

• Set policies for how receiving servers handle emails that fail SPF or DKIM checks
• Receive reports on email activity, failed authentication checks, and potential domain abuse

To fully protect your domain and recipients from email spoofing, implement DMARC after configuring SPF and DKIM.

Best practices¶

To maintain effective email authentication:

• Use DMARC alongside SPF and DKIM: DMARC acts as the control mechanism that enforces your authentication policies and provides visibility into how your domain is being used.
• Monitor DMARC reports regularly: review reports to identify failed SPF or DKIM checks and detect any unauthorised use of your domain.
• Keep DNS records consistent: ensure all domains used for sending email have up-to-date SPF, DKIM, and DMARC records. Inconsistent records can reduce deliverability and cause emails to be marked as spam.
• Review and update your SPF record: as your email infrastructure changes, update your SPF record to add new sources or remove obsolete ones.

Troubleshooting¶

DNS propagation¶

DNS changes can take anywhere from a few minutes to 48 hours to propagate. Verify your SPF and DKIM setup after allowing sufficient time for propagation.

SPF issues¶

DKIM issues¶

General issues¶