Understanding SPF, DKIM, and DMARC: A Simple Guide
Email admins and developers describe how hard it is to get SPF, DKIM, and DMARC configured correctly across ticketing systems, marketing platforms, forwarding setups, and small-business domains that lack in-house expertise. Even with “perfect” records, deliverability often still depends on opaque reputation systems run by large providers like Google, Microsoft, and Apple, leading many to favor hosted email over running their own servers. Participants share tools, automation services, and best practices—such as using subdomains, strict alignment, ARC for forwarding, and DMARC monitoring—to reduce misconfiguration, limit spoofing, and improve the odds that legitimate mail reaches the inbox.
Need for Better, Implementation-Focused Guidance
- Several posts ask for practical guides aimed at app/platform developers sending mail “on behalf of” customer domains.
- Common mistakes:
- Third-party platforms demanding SPF includes even when they correctly use their own envelope domain.
- Using the customer’s domain in both envelope and header addresses, breaking bounce handling and DMARC alignment.
- Strong advice: if you’re not a customer’s primary mail provider, avoid touching their SPF; rely on DKIM and appropriate subdomains instead.
SPF, DKIM, DMARC Nuances and Pitfalls
- Confusion over DMARC alignment: “strict vs relaxed” controls subdomain alignment only; you cannot require both SPF and DKIM to pass via DMARC.
- Operational pain:
- Misconfigured or outdated SPF records cause quarantines; some admins proactively contact senders with step‑by‑step fix instructions.
- SPF macros are rarely seen and often misunderstood.
- Hitting SPF’s 10‑lookup limit is common; suggested fix is moving each SaaS sender to its own subdomain SPF.
- Return-Path / envelope-from domain alignment is critical but often overlooked.
- Forwarding issues:
- DMARC + SPF break naive forwarding; SRS and ARC are discussed as workarounds.
- Gmail in particular is described as strict and opaque; some registrars’ forwarders don’t implement ARC or proper spam handling.
Tools, Automation, and Learning Resources
- Multiple validators and analyzers are recommended (DMARC/SPF/DKIM testers, DMARC monitoring dashboards), with mixed views on flashy “learn” UIs vs simple reports.
- Some argue guides have limited impact; automation that configures DNS for users (via Domain Connect–style services) is seen as more effective.
Running Your Own Mail Server
- Options mentioned: Mail-in-a-Box, docker-mailserver, Mailcow, NixOS-based setups, integrated mail servers (e.g., maddy/mox, Stalwart).
- Big hurdles: IP reputation, PTR records, matching HELO/A/MX, and large providers’ opaque blocklists.
- Experiences vary:
- Some report long-term success with careful setup and low volume.
- Others find Gmail/Microsoft essentially force use of big providers or relays.
- Debate over email’s future: some see it declining for person-to-person use but still central for accounts, notifications, and newsletters.
Policy, Ecosystem, and Diversity
- Concern about an “SMTP cartel” of major providers deciding deliverability, sometimes ignoring standards or giving little recourse.
- Calls for more email diversity: self-hosting or using smaller providers, though many ultimately choose hosted services (e.g., Fastmail) for reliability.