How SPF, DKIM and DMARC Work

In short: SPF, DKIM and DMARC are three DNS records that let receiving mail servers verify that a message really comes from your domain. SPF lists the servers allowed to send, DKIM signs each message so it cannot be altered, and DMARC tells receivers what to do when a check fails and where to send reports. None of them guarantees inbox placement on its own, but without all three your mail is increasingly rejected by Gmail, Outlook and Yahoo.

What SPF verifies

The SPF record is a TXT record on the domain that lists every server and service allowed to send mail as that domain: your mail server, your web server if it sends notifications, your newsletter provider. Example:

v=spf1 mx include:_spf.fiberserver.net.tr include:spf.newsletter-provider.com ~all

A domain must have exactly one SPF record. A second record causes a permanent error and every message fails; add new senders inside the existing record. Keep the number of DNS lookups under ten.

What DKIM provides

DKIM adds a digital signature to each outgoing message. The receiving server fetches the public key published in DNS (a TXT record under selector._domainkey.yourdomain.com) and checks the signature, which proves the message was sent by an authorised system and that its headers and body were not changed in transit. The selector and the key are provided by the mail service; publish the record name and value exactly as given. Fiberserver business email uses a CNAME to our shared key, so one record covers you.

The DMARC policy

DMARC combines the SPF and DKIM results with an alignment check (the visible From domain must match the authenticated domain) and tells receivers what to do with failures. It is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none, which only reports. Read the reports for a few weeks to find legitimate senders you forgot, then move to p=quarantine and finally p=reject. Jumping straight to reject blocks valid mail from services you did not list.

Recommended order

1. List every system that sends mail as your domain (mail server, website, CRM, newsletter tool).
2. Publish one valid SPF record that covers all of them.
3. Enable DKIM in each sending service and publish its key.
4. Publish DMARC with p=none and a report address.
5. Investigate unknown sources in the reports.
6. Tighten the policy step by step.

Why rDNS matters too

The mail server's IP address needs a PTR (reverse DNS) record pointing at the server's hostname, and that hostname must resolve back to the same IP and match the server's SMTP greeting. PTR records are managed by whoever provides the IP address; on Fiberserver VDS plans you set them from the panel.

Checking your setup

Send a message to a Gmail address and open "Show original": it lists SPF, DKIM and DMARC as PASS or FAIL. Our DNS lookup tool shows the published TXT records. If you use Fiberserver business email, the client area lists the exact records to add and checks them live.