Email DNS: MX, SPF, DKIM, and DMARC

July 16, 2026 ยท View on GitHub

Receiving and sending email are separate functions. MX records route incoming mail, while SPF, DKIM, and DMARC help receiving systems evaluate outgoing mail.

MX: Route Incoming Mail

A mail system may provide records similar to:

example.dpdns.org.  3600  MX  10  mx1.mail-system.example.
example.dpdns.org.  3600  MX  20  mx2.mail-system.example.

Lower preference numbers are tried first. Use every required record and do not replace the target hostname with an IP address.

Verify:

dig MX example.dpdns.org

SPF: Authorize Sending Sources

SPF is published as a TXT record at the domain used for envelope sending.

Name:  @
Type:  TXT
Value: v=spf1 include:_spf.mail-system.example -all

This value is only an illustration. Use the exact mechanisms required by every legitimate sender for the domain.

Important rules:

  • Publish one SPF policy per name, not several separate v=spf1 records.
  • Combine authorized sources carefully.
  • Understand the difference between -all, ~all, ?all, and +all before changing the final qualifier.
  • Remove sources that no longer send mail.
  • Keep the SPF DNS-lookup limit in mind when adding nested includes.

Verify:

dig TXT example.dpdns.org

DKIM: Sign Outgoing Messages

DKIM publishes a public key under a selector chosen by the mail system:

Name:  selector1._domainkey
Type:  TXT
Value: v=DKIM1; k=rsa; p=public-key-material-issued-by-the-mail-system

The private key remains in the sending mail system. Never place the private key in DNS.

Verify:

dig TXT selector1._domainkey.example.dpdns.org

DMARC: Define Alignment and Reporting Policy

DMARC is published at _dmarc:

Name:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.dpdns.org

Begin with monitoring when you do not yet understand every legitimate sending source. Move toward quarantine or rejection only after reviewing authentication results and alignment.

Addresses in rua can receive large XML aggregate reports. Use a mailbox designed to process them and confirm that the destination accepts reports for the domain.

Verify:

dig TXT _dmarc.example.dpdns.org

Authentication Alignment

DMARC evaluates whether the visible From domain aligns with a successful SPF or DKIM domain. A message can show SPF pass or DKIM pass and still fail DMARC if alignment is wrong.

Safe Rollout

  1. Inventory every system that sends mail for the domain.
  2. Publish the required MX records for incoming mail.
  3. Configure SPF for legitimate envelope senders.
  4. Enable DKIM signing and verify the selector.
  5. Publish a monitoring DMARC policy.
  6. Review reports and message headers.
  7. Tighten the policy only after legitimate mail consistently aligns.

Troubleshooting Evidence

Collect the complete authentication results from a test message header, the exact DNS answers, and the selector used. Remove message bodies, recipients, internal IDs, and other personal data before sharing evidence.

Continue to Verification and Service Records.