Email authentication setup guides
How to publish each email-authentication record in your DNS, written for people who would rather just get it done. Steps for the major hosts, and a free tool to check each one is live.
There are five records, and they each do one job. SPF lists who can send for you, DKIM signs your mail so it stays trusted through forwarding, and DMARC ties those two to the address people see and tells inboxes what to do when a check fails. MTA-STS forces encrypted delivery, and BIMI shows your logo once you are enforcing. If you can add a TXT record at your DNS host, you can follow any of these.
Choose a record to set up
SPF
List who can send for you and stay under the ten-lookup limit.
Set up SPFDKIM
Sign your mail with a key in DNS so it stays trusted through forwarding.
Set up DKIMDMARC
Tie SPF and DKIM together, collect reports, then move to enforcement.
Set up DMARCMTA-STS
Force encrypted delivery with a DNS record and a hosted policy file.
Set up MTA-STSBIMI
Show your verified logo once you are enforcing at quarantine or reject.
Set up BIMISet them up in this order
SPF and DKIM first
Sort out every real sender before any policy can act on it. Get each service passing SPF or signing DKIM under your own domain, so they are recognised when you switch enforcement on.
Then DMARC at p=none
Publish DMARC in monitor-only mode. Nothing gets blocked yet. Use the reports to confirm every real source lines up, then step the policy to quarantine and finally reject.
Then MTA-STS and BIMI
MTA-STS guards inbound mail and is independent, so add it whenever. BIMI depends on the others, so it goes last, once your policy is at quarantine or reject.
p=none lets you watch the reports and fix anything odd before it can do harm. Only then do you tighten the policy, and BIMI waits until the end because it needs that enforcement in place.What each record does, and where it trips people up
SPF
SPF is one TXT record listing who can send mail for your domain. A receiving server reads it and checks the IP that connected against your list. The catch is a limit most people hit by accident: SPF is only allowed ten DNS lookups, every include: for a sender eats into that, and the moment you go over, the whole record fails. The SPF guide covers naming every real sender, keeping a single SPF record on the domain, and using flattening so adding the next service does not push you over the line.
DKIM
DKIM signs each message and publishes the matching key in your DNS under a selector. The useful part is that the signature survives forwarding, which SPF does not, so it does most of the work when a mailbox provider decides whether to trust you. The DKIM guide covers generating 2048-bit keys, publishing the selector, getting each service to sign as your own domain so it aligns, and rotating to a new key later without leaving a gap.
DMARC
DMARC sits on top of SPF and DKIM. It checks that one of them lines up with the address your readers see, says what should happen to mail that fails, and mails you a daily report of everything sending under your name. The DMARC guide walks through publishing the record at _dmarc.yourdomain, starting at p=none so nothing gets blocked while you watch, and reading those reports before you turn the policy up.
MTA-STS
MTA-STS tells other servers not to deliver to you over a connection that is not properly encrypted, which shuts down a class of interception and downgrade attacks. It has two parts: a small DNS record, and a policy file you serve over HTTPS at a set address. The MTA-STS guide shows you how to publish both, how to switch on TLS-RPT so you hear about any delivery trouble, and why you start in testing mode rather than enforcing on day one.
BIMI
BIMI puts your logo next to your mail in inboxes that support it. There is a condition: it only kicks in once your domain is enforcing at p=quarantine or p=reject, and most inboxes also want a Verified Mark Certificate. The BIMI guide covers getting the SVG into the right format, publishing the record, and what the VMC actually involves, so the logo shows up instead of being ignored.
p=none to p=reject without knocking out your own mail is the whole job DMARC Engine does for you. We host your records, keep them right as your senders come and go, and walk your domain up to p=reject without breaking real mail.