The Modern Guide to DNS Records & Email Deliverability: SPF, DKIM, DMARC & BIMI

Email is the backbone of web communication, but SMTP was designed in 1982 with zero built-in identity authentication. Anyone can spoof the From: header of an email. To combat phishing, malware, and spam, the internet engineering community developed a triad of cryptographic DNS verification standards: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance).

1. SPF: Authorizing Sending IP Addresses

SPF is published as a DNS TXT record on your root domain. It tells receiving mail servers (Google Workspace, Microsoft 365, ProtonMail) which mail server IP addresses and third-party services (SendGrid, Mailgun, Postmark) are authorized to send mail on behalf of your domain:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:198.51.100.10 ~all

Key mechanisms and quantifiers:

• include: - Recursively delegate authorization to a third-party email provider's SPF record.
• ip4: / ip6: - Authorize static dedicated outbound mail server IPs or subnets.
• ~all (SoftFail) - Unlisted senders should be accepted but flagged as suspicious or routed to Spam.
• -all (HardFail) - Strictly reject any email from an unlisted IP address immediately at SMTP handshake.
• The 10-Lookup Limit: RFC 7208 mandates that evaluating an SPF record must not exceed 10 DNS lookups. Exceeding 10 lookups causes an SPF PermError, failing authentication!

2. DKIM: Cryptographic Signature of Email Headers & Body

While SPF verifies the sending server's IP address, DKIM verifies that the email content was not tampered with in transit. The sending server hashes the email body and critical headers, signs the hash using a private RSA key (2048-bit recommended), and attaches the signature in a DKIM-Signature header.

The public key is published in a DNS TXT record under a specific selector subdomain:

google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0t..."

3. DMARC: The Enforcement & Alignment Policy

SPF and DKIM alone do not prevent phishing because an attacker can pass SPF using their own domain while displaying your company name in the visual From: header. DMARC solves this by requiring domain alignment: the domain in the visible From: header must match the domain authenticated by SPF or DKIM.

Publish your DMARC record at _dmarc.yourdomain.com:

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; pct=100; adkim=r; aspf=r

DMARC policy options (p=):

• p=none (Monitoring Only) - Deliver email normally regardless of authentication failure; send daily XML aggregate reports to rua. Use for the first 30 days of testing.
• p=quarantine (Spam Folder) - Direct non-aligned emails to the recipient's spam/junk folder.
• p=reject (100% Protection) - Instruct receiving mail transfer agents to immediately drop and bounce any unauthenticated email claiming to come from your domain.

4. 2024+ Strict Sender Mandates (Google & Yahoo)

Starting in early 2024, Google and Yahoo jointly implemented mandatory requirements for bulk email senders (sending >5,000 emails/day):

1. Must have both SPF and DKIM configured.
2. Must have an active DMARC policy (at minimum p=none).
3. Must maintain a spam rate below 0.30% in Google Postmaster Tools.
4. Must support One-Click Unsubscribe (RFC 8058 List-Unsubscribe-Post header).
5. Must have valid forward and reverse DNS (PTR records) for sending IP addresses.

5. Interactive Webmaster & Security Tools

• Meta Tags & Head Auditor - Audit HTML head tags, OpenGraph previews, and canonical links.
• CIDR Subnet Calculator - Calculate IP ranges, netmasks, and broadcast addresses.
• IP Range to CIDR Calculator - Convert IP start/end ranges to optimal CIDR blocks.
• Common Network Ports Reference - Standard port numbers for SMTP (25, 465, 587) and IMAP (993).