SPF, DKIM, and DMARC Setup Guide

How the three records work together

SPF, DKIM, and DMARC solve related but different problems:

DMARC is the policy layer. It only becomes useful after SPF and DKIM are configured correctly.

Configure SPF

Publish one SPF TXT record on the domain used in the envelope sender. If Postscale gives you a Return-Path subdomain, SPF belongs on that subdomain.

ps-bounces.example.com.  TXT  "v=spf1 include:_spf.postscale.io -all"

Copy the underscore form exactly: include:_spf.postscale.io.

Keep the record short. SPF has a 10 DNS lookup limit across include, a, mx, ptr, exists, and redirect mechanisms.

Configure DKIM

Postscale signs mail with a selector under your domain. Add the provided TXT record:

ps2026._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=..."

Use a 2048-bit key where possible. Rotate DKIM keys by adding the new selector, waiting for verification, switching signing, and only then removing the old selector.

Configure DMARC

Start with reporting:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Use strict alignment (adkim=s; aspf=s) when you control the full sending setup. Use relaxed alignment only when legitimate subdomain patterns require it.

Read authentication results

Send a test message and inspect headers for:

Authentication-Results:
  spf=pass
  dkim=pass
  dmarc=pass

If SPF passes but DMARC fails, the SPF domain probably does not align with the visible From domain. If DKIM passes but DMARC fails, check the d= domain in the DKIM signature.

Move to enforcement

Use this sequence:

1. Publish p=none and collect reports.
2. Identify every legitimate sender.
3. Fix senders that fail DKIM or SPF alignment.
4. Move to p=quarantine; pct=25.
5. Increase pct gradually.
6. Move to p=reject when reports are clean.

Pair this guide with the DMARC reports guide so policy changes are based on evidence.