SPF, DKIM and DMARC explained

SPF: define permitted sending servers

An SPF record identifies the servers that may send email for a domain. The receiving mail server can check whether the sending IP address matches the published rule. SPF alone does not protect the visible From address and should therefore be combined with DKIM and DMARC.

DKIM: cryptographically sign messages

DKIM adds a digital signature to outgoing email. The corresponding public key is published as a DNS record. Recipients can verify that signed parts of the message have not changed in transit and that the signature belongs to the domain.

DMARC: control validation and failure handling

DMARC links SPF and DKIM to the domain visible in the From address. The domain owner can specify how recipients should handle messages that fail validation. A DMARC policy can start in monitoring mode and then be tightened gradually.

Configuration at SCHWENKE SYSTEMS

For the offered email mailboxes, the DNS values required by the mail service actually used are checked during setup. In particular, the existing mail service provides the domain-specific DKIM key. If SCHWENKE SYSTEMS manages the domain’s DNS, the agreed records can be set there. For externally managed DNS, you receive the required values for entry with the respective provider.

Additional sending services such as newsletters, shops or accounting systems must be considered separately in SPF, DKIM and DMARC. Automated DMARC report analysis is not part of the standard mailbox packages shown unless expressly agreed.

Important when making changes

Incomplete or conflicting DNS records can impair delivery. Existing records should therefore not be replaced without checking them first. For a specific review, please use the contact page.