Advanced SPF, DKIM, and DMARC configuration

DKIM keys

Use 2048-bit keys where supported. Publish the exact CNAME or TXT record shown by your sending provider. For long TXT records, use multiple quoted strings within one record if your DNS host requires it.

DMARC for subdomains

The sp= tag sets the policy for subdomains that inherit the parent policy. For example, v=DMARC1; p=none; sp=reject; rua=mailto:dmarc@example.com monitors the parent and requests rejection for failing subdomain messages. Confirm alignment for all legitimate senders before tightening policy.

SPF with multiple providers

Use the values each provider supplies for the configured return-path domain and account. Combine authorized senders in one SPF record per hostname and stay within the 10 DNS-lookup limit.

Customer domains and key rotation

For sending on behalf of customers, have each customer publish the DKIM records provided for their sending domain. When rotating keys, verify the new selector before switching and retain the previous selector long enough for mail already in transit. Check your deployment for its available rotation controls.

Test before sending

Send a test message and inspect the Authentication-Results header. Confirm SPF, DKIM, and DMARC results and verify that at least one passing identity aligns with the visible From domain. A test score alone cannot establish inbox placement.