Email Security: SPF, DKIM, DMARC Explained Simply
SPF defines who sends on your behalf. DKIM signs your messages. DMARC protects from spoofing. We explain all three — with copy-ready settings.
Why Email Security Matters
Email remains the most widely used medium for professional communication. It is also the primary target for phishing and impersonation attacks. Without properly configured authentication records, anyone can send messages that appear to come from your domain, putting your company's reputation and clients at risk.
Three fundamental protocols form your email's first line of defense: SPF, DKIM, and DMARC. Each protocol serves a specific function, and together they create a comprehensive protection system.
SPF: Who Is Authorized to Send on Your Behalf?
SPF (Sender Policy Framework) is a DNS record that specifies which servers are authorized to send email from your domain. When a receiving server gets a message from your domain, it checks the SPF record to verify the sending server is permitted.
How to Set Up SPF
Add a TXT record in your domain's DNS with the following format:
v=spf1 +a +mx ip4:YOUR.SERVER.IP -all
Component breakdown:
| Component | Meaning |
|---|---|
| v=spf1 | SPF version being used |
| +a | Allow the server linked to the A record |
| +mx | Allow MX servers |
| ip4:x.x.x.x | Allow a specific IP address |
| -all | Reject all other servers |
Important note: Use -all (hard fail) rather than ~all (soft fail). Hard fail prevents unauthorized servers from sending email on behalf of your domain.
DKIM: Is the Message Authentic and Unmodified?
DKIM (DomainKeys Identified Mail) adds an encrypted digital signature to every outgoing message. The receiving server uses the public key published in DNS to verify the message was not modified during transit.
How to Set Up DKIM
- From cPanel, navigate to Email Deliverability
- Select your domain and click Manage
- cPanel will automatically generate a key pair (public and private)
- The public key is added as a TXT record in DNS
- The private key stays on the server to sign messages
A DKIM record in DNS looks like this:
default._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjAN..."
DMARC: What Happens When Authentication Fails?
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and defines the policy that receiving servers should follow when authentication fails.
DMARC Policies
| Policy | Action | When to Use |
|---|---|---|
| p=none | No action, monitoring only | When starting, to collect reports |
| p=quarantine | Move to spam folder | After confirming settings are correct |
| p=reject | Reject the message entirely | Maximum protection after testing |
Gradual DMARC Implementation
Do not start with a reject policy immediately. Follow this progression:
- Weeks 1-2: p=none with reporting. Monitor who sends on behalf of your domain
- Weeks 3-4: p=quarantine with pct=50. Half of suspicious messages go to spam
- Month 2: p=quarantine with pct=100
- Month 3: p=reject after confirming no issues exist
Testing Your Configuration
After setting up all three records, test them using free tools such as:
- MXToolbox: Comprehensive DNS and email record checking
- Mail-Tester: Provides an overall score for your email configuration
- Google Postmaster Tools: Monitor your domain reputation with Google
Complete Setup with CLOUD
At CLOUD (cloud.net.sa), all email accounts come with SPF and DKIM pre-configured. The team assists with gradual DMARC implementation to ensure maximum protection without affecting legitimate message delivery.
Get Started
Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.
