SPF, DKIM and DMARC explained

Anyone can write any address in an email’s From line. SPF, DKIM and DMARC are how Gmail, Outlook and Yahoo tell a real email from your domain apart from a forgery. Without them, your login codes and receipts are far more likely to land in spam, or be rejected outright.

Since 2024, Gmail and Yahoo require SPF or DKIM for everyone, and DMARC for anyone sending more than 5,000 emails a day to their users. Vaartix sets up SPF and DKIM for you and helps you add DMARC.

SPF: which servers may send

Sender Policy Framework is a TXT record that lists the servers allowed to send for a domain. The receiving server checks the domain in the hidden return path (the address bounces go to), not the visible From address.

Vaartix uses send.yourdomain as the return path, so its SPF record lives there:

send.acme.in.  TXT  "v=spf1 include:amazonses.com ~all"

Because it’s on send., it never conflicts with the SPF record on your main domain, which may already list Google Workspace, Zoho Mail or Microsoft 365.

DKIM: a signature on every email

DomainKeys Identified Mail adds a cryptographic signature to each email. The receiving server fetches the public key from your DNS and checks that the email wasn’t changed on the way and really came from your domain.

Vaartix signs every email with 2048-bit keys. The three CNAME records point to keys that are rotated for you, so you never have to update them:

abc123._domainkey.acme.in.  CNAME  abc123.dkim.amazonses.com.

DMARC: what to do when checks fail

Domain-based Message Authentication, Reporting and Conformance ties the two together. It asks one question: does the domain that passed SPF or DKIM match the domain in the From line? This is called alignment. If neither aligns, DMARC tells the receiver what to do with the email.

With Vaartix both align: DKIM signs as acme.in, and the return path send.acme.in is a subdomain of acme.in, which counts under DMARC’s default relaxed alignment.

_dmarc.acme.in.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Tag	Meaning
p=none	Only monitor. Deliver as usual.
p=quarantine	Put failing email in spam.
p=reject	Refuse failing email.
rua=mailto:…	Where receivers send daily summary reports (optional).
pct=25	Apply the policy to only part of the failing email while you roll it out.

Caution

A domain can have only one DMARC record. If _dmarc.yourdomain already exists, keep it and don’t add ours.

Tighten DMARC safely

Start with p=none and move up once you’re sure every service that sends as your domain passes.

1. Monitor. Publish p=none with an rua address and read the reports for two to four weeks. They show every service sending as your domain: Vaartix, your office email, your CRM, your billing tool and so on.
2. Fix the stragglers. Set up SPF or DKIM for any legitimate sender that fails.
3. Quarantine. Change to p=quarantine. Add pct=25 first if you want to go gradually.
4. Reject. When reports stay clean, move to p=reject. Spoofed email with your domain now gets refused.

DMARC reports are XML files. Free tools such as Postmark’s DMARC digests, dmarcian or EasyDMARC turn them into readable summaries.

Check it worked

Send yourself an email through Vaartix, open it in Gmail and choose Show original. You should see:

SPF:   PASS with IP …
DKIM:  'PASS' with domain acme.in
DMARC: 'PASS'

If DKIM says the domain is amazonses.com instead of yours, the domain isn’t fully verified yet. Check its status with GET /domains/{id}.