Expected result documented and verified from the affected user path.
Pass / fail / blockedDNS and email guide
SPF, DKIM and DMARC without breaking mail
SPF authorizes sending infrastructure, DKIM signs messages and DMARC evaluates alignment and policy. They are complementary, not interchangeable.
4 diagnostic facts3 controlled stages4 acceptance checks2 primary references
Diagnose before changing
- 01Inventory every sender
- 02Find the single SPF TXT record
- 03Verify active DKIM selectors
- 04Inspect DMARC aggregate reports
- 01
Consolidate SPF
RFC 7208 permits one SPF record at an owner name. Merge authorized services instead of publishing competing records.
- 02
Enable DKIM
Generate keys in each sending service and publish its selector exactly as documented.
- 03
Roll out DMARC
Begin with monitoring, inspect alignment and legitimate senders, then strengthen policy deliberately.
Acceptance gate
Prove the result
Record timestamp, tester and evidence for every check before closing the incident or change.
Expected result documented and verified from the affected user path.
Pass / fail / blockedExpected result documented and verified from the affected user path.
Pass / fail / blockedExpected result documented and verified from the affected user path.
Pass / fail / blockedPrimary references