A route toauthenticate domain email
| Step | Action | Tip |
|---|---|---|
| 1 | ActionInventory senders | TipInclude mailboxes, CRM, forms, billing and newsletters |
| 2 | ActionConsolidate SPF | TipPublish one record containing every authorized source |
| 3 | ActionEnable DKIM | TipUse 2048-bit keys when the provider supports them |
| 4 | ActionObserve with DMARC | TipStart with p=none and review alignment reports |
| 5 | ActionEnforce and monitor | TipMove to quarantine/reject after validating legitimate traffic |
What each layer does
SPF authorizes senders, DKIM signs messages and DMARC checks alignment while telling receivers how to handle failures.
Recommended order
Inventory every legitimate sender, configure SPF and DKIM, validate each source, then publish DMARC in monitoring mode.
Move carefully
Review reports before progressing to a quarantine or reject policy. Authentication supports delivery, but reputation, consent and sending quality still matter.
Verified sources
Go deeper
These two resources expand on the key points with criteria, data and guidance from the organizations responsible for them.
It connects SPF and DKIM with DMARC and explains how policy tells a receiver what to do with messages that fail validation.
It defines DMARC identifier alignment, policies and reporting; it replaced RFCs 7489 and 9091 in May 2026.
