Three places a message names a domain
People see one sending address: the From address. The checks also read two others that people rarely see.
- The From address DMARC
From: news@example.com- On the letter. What people see in their inbox. DMARC protects this domain.
- The envelope sender SPF
Return-Path: <bounces@newsletter.example>- On the envelope. Where bounces go. SPF checks this domain.
- The DKIM signature DKIM
DKIM-Signature: d=example.com; s=k1- The seal. A signature the sending server adds. DKIM checks it with a key in this domain's DNS.
SPF: the servers allowed to send for a domain
SPF (Sender Policy Framework) is a TXT record in a domain's DNS. It lists the servers allowed to send mail for that domain.
The receiving server takes the domain of the envelope sender, looks up its SPF record, and checks whether the server it is talking to is on the list.
The server that sends the message sets the envelope sender, not the person who writes it. A sending service can put its own domain there, so that bounces come back to the service. SPF then passes for the service's domain, not for yours.
Checking SPF may take at most ten DNS lookups. Each include counts, and so does every lookup inside it. Over ten, SPF fails with an error. So does a domain with two SPF records.
When a message is forwarded, the forwarding server is not on your list, so SPF stops passing for your domain.
DKIM: the domain that signed the message
DKIM (DomainKeys Identified Mail) adds a signature to the message's headers. The signature names a domain in its d= tag and a selector in its s= tag.
The receiving server fetches the domain's public key from DNS and checks the signature with it. For selector k1 at example.com, the key is a TXT record at this name:
k1._domainkey.example.com
If the signature matches, the signed parts of the message have not changed since they were signed.
Any domain can sign any message. A sending service signs with its own domain until you set it up to sign with yours, which needs a DKIM record in your DNS.
A DKIM signature usually survives forwarding, because the message travels on unchanged. A mailing list that adds a footer or changes the subject breaks it.
DMARC: a pass that belongs to the From domain
DMARC reads the domain in the From address and looks for a passing check that belongs to it. A message passes DMARC when at least one of these is true:
- SPF passes, and the envelope sender's domain matches the From domain.
- DKIM passes, and the signature's d= domain matches the From domain.
This match is called alignment. By default a subdomain counts, so mail.example.com matches example.com. A record can ask for the exact domain instead, with adkim=s for DKIM or aspf=s for SPF.
SPF and DKIM can both pass while DMARC fails. That happens when both pass for someone else's domain, as with a sending service that has not been set up for yours.
| Check | Passes for | Aligned |
|---|---|---|
| SPF | newsletter.example | No |
| DKIM | example.com | Yes |
DKIM passes for example.com, the From domain, so the newsletter passes DMARC. The SPF pass for newsletter.example does not count towards it.
What to set up for each service
For every service that sends mail with your domain in the From address:
- Set it up to sign with your domain, by publishing the DKIM record it needs in your DNS.
- If it sends with your domain as the envelope sender, add it to your SPF record.
- Check in your DMARC reports that its mail passes DMARC.
Get DKIM right first. It survives forwarding, and one aligned pass is enough for DMARC.