Your SaaS sends invoices, password resets, and ops alerts from three providers: in-house SMTP, SendGrid, helpdesk. Everything "works" until Microsoft 365 junk-filters 40% of mail. Main domain SPF authorizes too much, DKIM runs on helpdesk only, and nobody read the first DMARC aggregate report.
SPF, DKIM, and DMARC are not three buzzwords to tick at the mail host. They are three complementary mechanisms with a often-forgotten condition: alignment.
SPF: who may send for your domain
SPF lists authorized servers in a TXT _spf.example.com. Classic mistakes: +all, too many include: chains, forgotten transactional ESP, 10 DNS lookup limit.
SPF checks SMTP envelope (MAIL FROM), not always visible From. An attacker can display you@example.com while passing SPF on their own domain.
DKIM: cryptographic signature
DKIM signs message parts with a DNS-published key. Often survives modest forwarding. Use distinct selectors per service.
Key rotation: plan before expiry; some registrars require long TXT — check fragmentation.
DMARC: policy + reports
DMARC says what to do if SPF or DKIM fails and From alignment is wrong. Start with p=none; rua=mailto:dmarc@example.com.
| Phase | Policy | Goal |
|---|---|---|
| 1 | p=none | Inventory legitimate senders |
| 2 | p=quarantine | Reduce spoofing |
| 3 | p=reject | Block spoofing |
Read aggregate XML — automate parsing at scale.
Alignment: the killer detail
Relaxed: mail.example.com aligns with example.com. Strict: exact domain match.
Common case: From hello@example.com, DKIM d=esp.net → SPF/DKIM OK, DMARC fail. Fix Return-Path, DKIM signer, or use a dedicated subdomain.
Multi-provider checklist
- Inventory sending IPs/domains.
- Consolidated SPF or subdomain per channel.
- DKIM per ESP + mail-tester.com.
- DMARC p=none 30+ days.
- BIMI only after stable reject.
Seven-day action plan
Day 1 — Export all existing TXT and MX records. List every sending service (app, CRM, newsletter, monitoring, support).
Day 2 — Publish or consolidate SPF with final -all after includes. Verify DNS lookup count (<10).
Day 3 — Enable DKIM on first ESP; send tests to Gmail and Microsoft; inspect Authentication-Results headers.
Day 4 — Publish DMARC p=none with working rua address. Configure mailbox or aggregate parser.
Day 5 — Analyze first reports: unknown legitimate sources, alignment failures, third-party forwarding.
Day 6 — Fix Return-Path and missing selectors. Re-test critical transactional sends (invoice, password reset).
Day 7 — Document runbook "add new sender": SPF include, DKIM, DMARC test, marketing validation.
This week avoids the classic trap: enable reject day one and discover a forgotten internal tool via customer bounces.
Forwarding and mailing lists
Mailing lists break SPF — expect DMARC fails on forwarded mail; educate users or use ARC if provider supports.
Helpdesk From rewrite affects alignment — configure ticket system DKIM on your domain.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Shared mail vs ESP
Shared IP caps reputation. ESP requires DKIM on your domain. Truncated TXT = intermittent DKIM. Quarterly marketing aggregate review.
Decide and move forward without blind spots
- Inventory senders — app, CRM, newsletter, monitoring, support: one row per service with IP, Return-Path domain, and DKIM selector.
- Consolidate SPF — final
-all, fewer than ten DNS lookups, per-channel includes if needed. - Enable DKIM everywhere — test Gmail and Microsoft, read Authentication-Results headers.
- Publish DMARC
p=none— working rua address, at least 30 days of aggregate analysis before quarantine. - Tighten gradually — quarantine then reject only when reports hold no surprises.
If you hesitate between shared SMTP and a transactional ESP, compare IP reputation and TXT flexibility in our comparison tool and directory. Mail field notes on the blog.
Frequently asked questions
Is SPF alone enough?
No. SPF breaks on forwarding and does not cover spoofed From headers. DKIM and DMARC cover those blind spots.
What is DMARC alignment?
The From header domain must match (strict) or be a parent (relaxed) of the SPF or DKIM validated domain. Without alignment, DMARC fails even if SPF and DKIM pass alone.
Where to start deployment?
Publish SPF and DKIM, then DMARC at p=none with rua/ruf reports, analyze a month, tighten to quarantine then reject.
Do subdomains inherit parent DMARC?
Not automatically. Add sp= or explicit DMARC policies per sending subdomain.
Open your latest DMARC aggregate report before adding a new ESP — or you will discover the conflict via customers, not DNS.