In this article, you will learn:
- What SPF, DKIM and DMARC are for and how they work
- How to set up these mechanisms
- Common problems
- Frequently asked questions
SPF, DKIM and DMARC
SPF, DKIM and DMARC are measures against fraudulent emails. If you do not use them, or do not have them configured correctly, you increase the chance that the recipient’s system will mark your message as spam, or reject your email and return it as undeliverable.
- SPF (Sender Policy Framework) is an email authentication system that allows domain owners to specify, via a special DNS record, which servers are allowed to send emails on behalf of their domain. Recipients can then verify SPF records and decide whether to accept, reject, or otherwise process the email.
- DKIM (DomainKeys Identified Mail) is a method that allows the organization responsible for sending an email to attach a digital signature to the message. Recipients can verify this signature and confirm that the email was not changed after sending and that it comes from a legitimate source.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication policy and reporting protocol that helps protect email domains from abuse such as phishing and spoofing. DMARC uses SPF and DKIM to verify that outgoing emails are legitimate and defines how the recipient should handle emails that fail verification. It is configured through a special DNS record.
Setting up email authentication mechanisms
To ensure maximum deliverability of your mail, configure all the mentioned protective mechanisms. Whenever you change providers, or add another one (for example, if you use a bulk email sending service in addition to our mail), make sure you integrate SPF correctly, especially according to that provider’s manual.
Configuring the SPF record
The SPF record specifies the servers authorized to send mail on behalf of the domain or subdomain for which it is set. A detailed guide to configuring DNS records can be found in the article DNS – Domain Records.
Set at most 1 SPF record for the domain. Adding multiple records will invalidate SPF verification.
If you use only VEDOS services for sending emails (Webhosting, WebSite, Mailhosting) without WEDOS Protection ⧉, set the SPF record:
Name TTL Type Data (empty) 300 TXT v=spf1 mx a include:_spf.we.wedos.net -all
If you use only another email provider, use SPF according to its instructions. If you need to enter more than one provider, or are dealing with SPF problems, follow the article Email – SPF record.
Configuring DKIM
We handle email verification through DKIM entirely on our side.
For verifying messages sent from Webhosting via the PHP mail() function, we use these DNS records, which we usually generate automatically on our servers:
Name TTL Type Data key1.wedos-dkim._domainkey 300 CNAME key1.dkim-we.wedos.net key2.wedos-dkim._domainkey 300 CNAME key2.dkim-we.wedos.net
If you use external DNS, or these records are missing for a domain pointing to our Webhosting for any reason, add them. For these records to work properly, also ensure correct return-path parameter setup.
Emails sent via SMTP are verified using a shared DKIM key at shared.dkim-wes1.wedos.net. This setting is automatic, you do not need to enable it anywhere, but you also cannot disable it.
Configuring DMARC
The basic DMARC record, which improves email deliverability, has the following form:
Name TTL Type Data _dmarc 300 TXT v=DMARC1; p=none; rua=mailto:vas-email@domena.tld
where you replace vas-email@domena.tld with the email address to which you want any aggregated reports to be sent.
Common problems
Common problems include:
- Continued spamming or mail delivery failures
- Broken SPF, DKIM and DMARC when sending via the mail() function from Webhosting
- Displaying a message about sending via the domain shared.dkim-wes1.wedos.net
- Incompatible DMARC
Mail with SPF, DKIM and DMARC is undeliverable
Problem: Even though SPF, DKIM and DMARC are set up, mail ends up in spam or is not delivered at all.
Solution: Check that all records are set up correctly and propagated (DNS record changes may take 30 – 60 minutes or longer to take effect). The most common mistake is having multiple SPF records for one domain and placing record data in quotation marks.
If you suspect email blocking by the sender or recipient, follow the instructions in Email – Blocking.
Sending via the mail() function
Problem: When sending via the mail() function on Webhosting, SPF, DKIM and DMARC fail.
Cause: In the default mail() function setup, such emails are sent by the Webhosting server, for example hcX-wdXXX.wedos.net, to which your configured records do not apply.
Solution: Set a return-path in the mail() function containing an address on your domain according to this guide.
Via the domain shared.dkim-wes1.wedos.net
Problem: The recipient sees an unwanted message about sending via the domain shared.dkim-wes1.wedos.net.
Solution: Make sure your SPF record is set up correctly and propagated. If it is, this message should not appear.
Incompatible DMARC
Problem: Advanced DMARC settings mark messages as problematic.
Cause: For mails sent via shared.dkim-wes1.wedos.net, DKIM alignment does not work properly.
Solution: Make sure you have valid SPF, and if necessary, adjust the DMARC record parameters.
Frequently asked questions
Is all of this really necessary?
If you want your emails to be trustworthy, yes. Different providers have different rules for spam filtering and email rejection, but at minimum SPF and DKIM are key to ensuring reliable delivery.
Can you set it up for me?
You can set up DKIM DNS automatically by pointing the domain to hosting according to this guide. We usually do not set up SPF and DMARC records, because we do not have enough information about the mail services you use and could jeopardize their operation by configuring them incorrectly. We can set up the basic records listed in this guide for you, but this is a paid service according to the price list.
How do I make sense of DMARC reports?
You can find the basics of reading DMARC reports, for example, in our community guide ⧉.