# 4 Email authentication (SPF/DKIM/DMARC)

> v0.2.0 · role: Prevent · edition: All (DNS-side) · [policy: #6 · #27](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Unlocks: [№30 MTA-STS + TLS reporting](mta-sts.md)

Email is easy to spoof. SPF, DKIM and DMARC exist to let the receiving server verify that mail claiming to come from your domain actually did, which is what stops an attacker spoofing your domain to your own staff and to your partners. This is mostly a one-time setup task in the DNS settings of your domain (see the air-gapped recovery kit, [№57](air-gapped-recovery.md)).

Visual explainer: [Why emails have three sender names, and what DMARC actually chains together](../explainer/email-authentication/index.html)

Documentation: [About authentication methods](https://knowledge.workspace.google.com/admin/security/about-authentication-methods)

## Caveats

- DMARC at p=none authenticates nothing — it only reports, and the control is not complete until p=quarantine or p=reject.

## Setup steps

1. Select the sending domain and generate the DKIM key. — `Apps › Google Workspace › Gmail › Authenticate email`

   - **Selector prefix** = google
   - **Key length** = 2048-bit

   docs: [Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim)

2. Publish the printed TXT record at your DNS provider, wait for propagation, then return and start authentication. — `Apps › Google Workspace › Gmail › Authenticate email`

   ```
   TXT google._domainkey = <value from console>
   ```
   Note: Starting authentication before the TXT record has propagated fails with 'DNS record not found' — re-check propagation rather than regenerating the key.

   docs: [Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim)

3. DNS step (outside the Admin Console): publish SPF for Google's senders.

   ```
   TXT @ = v=spf1 include:_spf.google.com ~all
   ```

   docs: [Set up SPF](https://knowledge.workspace.google.com/admin/security/set-up-spf)

4. DNS step: publish DMARC, starting at p=none with rua reporting, then ratchet to quarantine and reject once reports are clean.

   ```
   TXT _dmarc = v=DMARC1; p=none; rua=mailto:dmarc@<domain>; adkim=s; aspf=s
   ```
   Note: Every third-party sender (CRM, mailer, ticketing) must be in SPF/DKIM before the ratchet — otherwise enforcement drops legitimate mail.

   docs: [Set up DMARC](https://knowledge.workspace.google.com/admin/security/set-up-dmarc)

## Ongoing maintenance

- **[automatable: AI agent]** Monthly: review DMARC aggregate (rua) reports for unexpected senders before tightening or after adding a SaaS mailer.
- **[requires a human]** When adding any sending service: update SPF without exceeding the 10-lookup limit.

## How to verify

1. Go to https://www.learndmarc.com/ and send an email to see if everything is set up correctly.

2. Alternatively, if you know your way around a terminal: Check all three records directly from your machine:

   ```dig +short TXT <domain> | grep spf1; dig +short TXT google._domainkey.<domain>; dig +short TXT _dmarc.<domain>```

3. SPF must end in ~all or -all, the DKIM key must be 2048-bit, and DMARC must carry p=quarantine or p=reject with a rua= address that is monitored.

## Settings screens

- Apps > Google Workspace > Gmail > Authenticate email (DKIM)
  - console: https://admin.google.com/ac/apps/gmail/authenticateemail
  - screenshot: ../screenshots/admin.google.com/ac/apps/gmail/authenticateemail.png
- Apps > Google Workspace > Gmail (settings landing — fallback if the DKIM deep link moves)
  - console: https://admin.google.com/ac/managedsettings/740348119625
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/740348119625.png