Preguntas frecuentes
What is SPF and why do I need it?
SPF (Sender Policy Framework) is a DNS record on your domain that lists which mail servers are authorized to send email on your behalf. When an email arrives claiming to be from your domain, the receiving server checks your SPF record to verify the sending server is on your approved list. Without SPF, anyone can send emails that claim to be from your domain, and inbox providers have no way to verify authenticity. SPF alone does not prevent all spoofing but it is a required piece of the authentication puzzle that forms the foundation for DKIM and DMARC.
What is DKIM and how does it work?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails that proves they were sent by an authorized sender and have not been modified in transit. Your email platform generates a public-private key pair where the private key signs outgoing emails and the public key is published as a DNS record on your domain. Receiving mail servers use your public key to verify the signature. DKIM is more powerful than SPF because the signature travels with the email and survives forwarding, which SPF does not handle well. Both Google and Yahoo require DKIM for bulk senders.
What is DMARC and do I really need it?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that sits on top of SPF and DKIM. It tells inbox providers what to do when an email fails authentication (none, quarantine, or reject) and lets you receive reports about emails being sent that claim to be from your domain. Google and Yahoo require a minimum DMARC policy of p=none for bulk senders, but the real security and deliverability benefits come from moving to p=quarantine or p=reject. You should start at p=none with monitoring, analyze your DMARC reports for a few weeks, and then move to enforcement once you are confident all legitimate sending sources are authenticated.
How do I know if my authentication is set up correctly?
The quickest way is to send a test email to mail-tester.com or check your headers in Gmail by clicking the three-dot menu and "Show original." You should see authentication results showing SPF pass, DKIM pass, and DMARC pass. Tools like MXToolbox (mxtoolbox.com) let you look up your SPF and DKIM records directly in your DNS. Google Postmaster Tools also shows your DKIM alignment score for emails being delivered to Gmail. Most email platforms have their own authentication checker built into the sending domain setup flow, which is the best place to start.
What happens if I have too many SPF includes?
SPF has a hard limit of 10 DNS lookups per record. Many senders hit this limit accidentally by including multiple email services (marketing platform, CRM, customer support tool, transactional email) each with their own SPF includes. When you exceed 10 lookups, SPF permanently fails for your domain even if everything else is configured correctly. The fix is to flatten your SPF record using a service like dmarcian or AuthSMTP's SPF flattener, which resolves all the nested includes to a direct list of IP addresses. This is a real problem worth checking if you use multiple tools that send email on your behalf.
Should I use a subdomain for email authentication?
Using a subdomain like mail.yourdomain.com or em.yourdomain.com for email sending is a good practice that many security-conscious teams use. It lets you set email-specific authentication records without touching your root domain's DNS, and if your email program ever has a deliverability problem, the impact is isolated to the subdomain rather than affecting your primary domain. Many email platforms default to a subdomain setup and it is worth following their recommended configuration. The tradeoff is slightly more DNS complexity but the protection is usually worth it.