spf-dkim-dmarc-setuplisted

# SPF, DKIM and DMARC Three DNS records that tell receiving servers your mail is genuinely yours. Without all three, a significant share of your email is filtered before any content check happens — and since Google and Yahoo tightened bulk sender requirements, authentication is a prerequisite rather than an optimisation. Set them up before sending anything. Debugging them after a domain has been damaged is much slower. ## SPF A TXT record on the domain listing who may send for it. ``` v=spf1 include:_spf.google.com include:sendgrid.net ~all ``` | Part | Meaning | |---|---| | `v=spf1` | Version. Always first | | `include:` | Delegate to a provider's own SPF record | | `ip4:` / `ip6:` | Authorise a specific address or range | | `~all` | Soft fail — anything else is suspicious | | `-all` | Hard fail — anything else is forged | | `?all` | Neutral. Pointless, don't use | **The rules that break in practice:** - **One SPF record per domain.** Two TXT records both starting `v=spf1` is a permanent fail, and it silently breaks all your mail. It happens when a second provider is added by someone who doesn't know a record already exists. Merge the includes into one record. - **Ten DNS lookup limit.** Each `include:` costs at least one lookup and nested includes count too. Exceed ten and the result is `permerror`, which most receivers treat as a fail. Big providers' includes are expensive; four or five is often enough to hit the ceiling. - **`~all` over `-all`** while getting star