Set up DKIM, SPF and DMARC for a domain

Before you start#

Large mailbox providers expect mail to be authenticated. On a StackRegent server, mail runs on MailEnable, and the three records work like this:

• SPF lists the servers allowed to send mail for the domain. New zones get v=spf1 +a +mx -all from the DNS template.
• DKIM signs each outgoing message with a key whose public half is published in DNS at <selector>._domainkey.<domain>.
• DMARC tells receivers what to do when SPF and DKIM fail. New zones get _dmarc.<domain> with v=DMARC1; p=none, which only monitors.

You need MailEnable installed, the domain's mail service on and, for the best results, a reverse DNS (PTR) record for the server's IP address that matches the Mail host name in Tools & Settings › Mail Server Settings.

Step 1: Allow DKIM on the server#

Go to Tools & Settings › Mail Server Settings and, under Signing, tick DKIM (Allow DKIM signing of outgoing mail). Click Save. If this is off, no domain signs, whatever its own setting says.

Step 2: Turn on DKIM for the domain#

Open the subscription, click Mail and choose the Mail Settings tab. Click Change on the domain's card, tick Sign outgoing mail with DKIM and save. Customers do the same in their own panel. The key is created with the next update of the domain's mail.

Step 3: Publish the DKIM record#

If this server hosts the domain's DNS, there is nothing to do: the key is published in the zone, and the card shows the DKIM signing selector as published in DNS. If DNS is hosted elsewhere, the card says so and shows the exact TXT record to add at the DNS provider, with its name <selector>._domainkey.<domain>. Copy it as shown.

Step 4: Check SPF#

The same card shows the SPF record in use. If the domain also sends through another service, such as a newsletter platform or an office suite, add that service's part to the same record, for example an include: it gives you. A domain must have only one SPF record. If DNS is elsewhere, add a record such as v=spf1 a mx -all there, adjusted to the services you use.

Step 5: Start DMARC in monitoring mode#

The template's v=DMARC1; p=none asks receivers to report but not to act. To get the reports, edit the record in the website's DNS Settings and add a reporting address, for example v=DMARC1; p=none; rua=mailto:dmarc@example.com. Leave it like this for a couple of weeks and read what arrives.

Step 6: Test a message#

Send a message from a mailbox on the domain to an outside mailbox and open the message headers. Look for dkim=pass, spf=pass and dmarc=pass in the Authentication-Results header. On the server, stackregent dkim-verify FILE checks the DKIM signatures of a saved message.

Step 7: Tighten DMARC#

When the reports show that all legitimate mail passes, change the policy to p=quarantine and later to p=reject. Do this per domain, and only after every service that sends for the domain is covered by SPF or signs with DKIM.

If mail still lands in spam#

Authentication is one part of reputation. Check the PTR record, make sure the server's IP is not on a block list, keep outgoing limits on so a hacked mailbox cannot send bursts, and use a smarthost if your provider's IP range has a poor reputation. Mail not delivered goes through these checks. The mail server chapter and the customer's email guide have the full settings.