Browse the Learning Center

Learning paths

Ordered reading paths through DMARC, SPF and DKIM — from an unprotected domain to an enforced policy.

Get to p=reject

The full route from an unprotected domain to an enforced policy, in the order the work actually happens.

  1. What DMARC actually does
  2. Publish your first record
  3. Read your first report
  4. Fix SPF before you tighten
  5. Move to quarantine, then reject

The three records

SPF, DKIM and DMARC explained in the order they make sense — start here if the acronyms are new.

  1. SPF: who may send
  2. DKIM: proving it wasn't altered
  3. DMARC: what to do on failure

Add a sending platform

Authorise a new ESP without breaking the authentication you already have.

  1. Know what you're editing
  2. Add the platform's records
  3. Stay under the lookup limit

Fix a failing sender

Mail is bouncing or landing in spam. Work the causes in order of likelihood.

  1. Read the failure
  2. Check DKIM alignment
  3. Body-hash failures