4 Email authentication (SPF/DKIM/DMARC)

Email is easy to spoof. SPF, DKIM and DMARC exist to let the receiving server verify that mail claiming to come from your domain actually did, which is what stops an attacker spoofing your domain to your own staff and to your partners. This is mostly a one-time setup task in the DNS settings of your domain (see the air-gapped recovery kit, №57).

Visual explainer Why emails have three sender names, and what DMARC actually chains together

Documentation: About authentication methods

Caveats

DMARC at p=none authenticates nothing — it only reports, and the control is not complete until p=quarantine or p=reject.

Setup steps

Select the sending domain and generate the DKIM key.

open ↗

https://admin.google.com/ac/apps/gmail/authenticateemail · captured 2026-07-15

Apps › Google Workspace › Gmail › Authenticate email

Selector prefix

google

Key length

2048-bit

Set up DKIM
Publish the printed TXT record at your DNS provider, wait for propagation, then return and start authentication.
open ↗

https://admin.google.com/ac/managedsettings/740348119625 · captured 2026-07-15

Apps › Google Workspace › Gmail › Authenticate email
```
TXT google._domainkey = <value from console>
```
Starting authentication before the TXT record has propagated fails with 'DNS record not found' — re-check propagation rather than regenerating the key.
DNS step (outside the Admin Console): publish SPF for Google's senders.
```
TXT @ = v=spf1 include:_spf.google.com ~all
```
Set up SPF
DNS step: publish DMARC, starting at p=none with rua reporting, then ratchet to quarantine and reject once reports are clean.
```
TXT _dmarc = v=DMARC1; p=none; rua=mailto:dmarc@<domain>; adkim=s; aspf=s
```
Every third-party sender (CRM, mailer, ticketing) must be in SPF/DKIM before the ratchet — otherwise enforcement drops legitimate mail.

Set up DMARC

Ongoing maintenance

automatable: AI agent Monthly: review DMARC aggregate (rua) reports for unexpected senders before tightening or after adding a SaaS mailer.
requires a human When adding any sending service: update SPF without exceeding the 10-lookup limit.

How to verify

Go to https://www.learndmarc.com/ and send an email to see if everything is set up correctly.
Alternatively, if you know your way around a terminal: Check all three records directly from your machine:

```dig +short TXT <domain> | grep spf1; dig +short TXT google._domainkey.<domain>; dig +short TXT _dmarc.<domain>```
SPF must end in ~all or -all, the DKIM key must be 2048-bit, and DMARC must carry p=quarantine or p=reject with a rua= address that is monitored.

v0.2.0 Prevent edition All (DNS-side) policy #6 · #27 ↗