[{"data":1,"prerenderedAt":1042},["ShallowReactive",2],{"blog-en-spf-dkim-dmarc-configuration":3,"blog-related-en-spf-dkim-dmarc-configuration":1029},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"updated":10,"body":11,"_type":1023,"_id":1024,"_source":1025,"_file":1026,"_stem":1027,"_extension":1028},"/en/blog/spf-dkim-dmarc-configuration","blog",false,"","SPF, DKIM, DMARC: Configure Your Domain Step by Step","Set up SPF, DKIM, and DMARC on your sending domain with concrete DNS examples and the most common configuration mistakes to avoid.","2026-08-27",{"type":12,"children":13,"toc":997},"root",[14,22,29,34,56,74,92,97,103,110,132,138,143,152,157,206,227,233,243,248,256,261,268,273,287,322,340,346,352,357,363,368,376,410,415,451,457,462,467,473,479,492,498,506,510,556,562,640,646,656,668,714,724,744,750,755,760,792,804,827,832,855,868,874,879,892,896,902,967,970,991],{"type":15,"tag":16,"props":17,"children":18},"element","p",{},[19],{"type":20,"value":21},"text","Your emails do not reach the inbox because you write well -- they reach it because receiving servers trust your domain. SPF, DKIM, and DMARC are the three DNS records that establish that trust, and misconfiguring any one of them quietly breaks the other two.",{"type":15,"tag":23,"props":24,"children":26},"h2",{"id":25},"why-all-three-records-are-required",[27],{"type":20,"value":28},"Why All Three Records Are Required",{"type":15,"tag":16,"props":30,"children":31},{},[32],{"type":20,"value":33},"Each protocol solves a distinct problem.",{"type":15,"tag":16,"props":35,"children":36},{},[37,43,45,54],{"type":15,"tag":38,"props":39,"children":40},"strong",{},[41],{"type":20,"value":42},"SPF (Sender Policy Framework)",{"type":20,"value":44}," declares which IP addresses are authorized to send email on behalf of your domain. The specification is defined in ",{"type":15,"tag":46,"props":47,"children":51},"a",{"href":48,"rel":49},"https://www.rfc-editor.org/rfc/rfc7208",[50],"nofollow",[52],{"type":20,"value":53},"RFC 7208",{"type":20,"value":55},".",{"type":15,"tag":16,"props":57,"children":58},{},[59,64,66,73],{"type":15,"tag":38,"props":60,"children":61},{},[62],{"type":20,"value":63},"DKIM (DomainKeys Identified Mail)",{"type":20,"value":65}," adds a cryptographic signature to every outgoing message. The recipient's server retrieves your public key from DNS and verifies the message was not modified in transit. The standard is ",{"type":15,"tag":46,"props":67,"children":70},{"href":68,"rel":69},"https://www.rfc-editor.org/rfc/rfc6376",[50],[71],{"type":20,"value":72},"RFC 6376",{"type":20,"value":55},{"type":15,"tag":16,"props":75,"children":76},{},[77,82,84,91],{"type":15,"tag":38,"props":78,"children":79},{},[80],{"type":20,"value":81},"DMARC (Domain-based Message Authentication, Reporting and Conformance)",{"type":20,"value":83}," ties SPF and DKIM together. It defines what happens when a message fails authentication and where reports should be sent. See ",{"type":15,"tag":46,"props":85,"children":88},{"href":86,"rel":87},"https://www.rfc-editor.org/rfc/rfc7489",[50],[89],{"type":20,"value":90},"RFC 7489",{"type":20,"value":55},{"type":15,"tag":16,"props":93,"children":94},{},[95],{"type":20,"value":96},"A domain with SPF and DKIM but no DMARC has no enforcement policy -- spoofed messages from unlisted sources can still reach inboxes. A domain with DMARC but broken SPF or DKIM will see legitimate messages fail. The three records form a single system.",{"type":15,"tag":23,"props":98,"children":100},{"id":99},"setting-up-spf",[101],{"type":20,"value":102},"Setting Up SPF",{"type":15,"tag":104,"props":105,"children":107},"h3",{"id":106},"how-spf-works",[108],{"type":20,"value":109},"How SPF Works",{"type":15,"tag":16,"props":111,"children":112},{},[113,115,122,124,130],{"type":20,"value":114},"SPF is a TXT record published at your root domain. When a receiving server gets a message from ",{"type":15,"tag":116,"props":117,"children":119},"code",{"className":118},[],[120],{"type":20,"value":121},"you@yourdomain.com",{"type":20,"value":123},", it queries ",{"type":15,"tag":116,"props":125,"children":127},{"className":126},[],[128],{"type":20,"value":129},"yourdomain.com",{"type":20,"value":131}," for the SPF record and checks whether the sending IP is authorized.",{"type":15,"tag":104,"props":133,"children":135},{"id":134},"writing-your-spf-record",[136],{"type":20,"value":137},"Writing Your SPF Record",{"type":15,"tag":16,"props":139,"children":140},{},[141],{"type":20,"value":142},"A concrete example:",{"type":15,"tag":144,"props":145,"children":147},"pre",{"code":146},"v=spf1 ip4:203.0.113.10 include:smtp.infomaniak.com ~all\n",[148],{"type":15,"tag":116,"props":149,"children":150},{"__ignoreMap":7},[151],{"type":20,"value":146},{"type":15,"tag":16,"props":153,"children":154},{},[155],{"type":20,"value":156},"Each part:",{"type":15,"tag":158,"props":159,"children":160},"ul",{},[161,173,184,195],{"type":15,"tag":162,"props":163,"children":164},"li",{},[165,171],{"type":15,"tag":116,"props":166,"children":168},{"className":167},[],[169],{"type":20,"value":170},"v=spf1",{"type":20,"value":172}," -- protocol version, always present and always first",{"type":15,"tag":162,"props":174,"children":175},{},[176,182],{"type":15,"tag":116,"props":177,"children":179},{"className":178},[],[180],{"type":20,"value":181},"ip4:203.0.113.10",{"type":20,"value":183}," -- a specific IPv4 address your server sends from",{"type":15,"tag":162,"props":185,"children":186},{},[187,193],{"type":15,"tag":116,"props":188,"children":190},{"className":189},[],[191],{"type":20,"value":192},"include:smtp.infomaniak.com",{"type":20,"value":194}," -- inherits the SPF record published by your SMTP provider",{"type":15,"tag":162,"props":196,"children":197},{},[198,204],{"type":15,"tag":116,"props":199,"children":201},{"className":200},[],[202],{"type":20,"value":203},"~all",{"type":20,"value":205}," -- softfail: messages from unlisted sources are accepted but flagged",{"type":15,"tag":16,"props":207,"children":208},{},[209,211,217,219,225],{"type":20,"value":210},"If you send through your own SMTP server (OVH, Infomaniak, or a self-hosted instance), add its IP directly with ",{"type":15,"tag":116,"props":212,"children":214},{"className":213},[],[215],{"type":20,"value":216},"ip4:",{"type":20,"value":218},". If your provider publishes its own SPF record, use ",{"type":15,"tag":116,"props":220,"children":222},{"className":221},[],[223],{"type":20,"value":224},"include:",{"type":20,"value":226}," instead of listing raw IPs.",{"type":15,"tag":104,"props":228,"children":230},{"id":229},"the-double-spf-mistake",[231],{"type":20,"value":232},"The Double SPF Mistake",{"type":15,"tag":16,"props":234,"children":235},{},[236,241],{"type":15,"tag":38,"props":237,"children":238},{},[239],{"type":20,"value":240},"A domain can only have one SPF TXT record.",{"type":20,"value":242}," If you publish two, most resolvers will reject both, and every message you send will fail SPF.",{"type":15,"tag":16,"props":244,"children":245},{},[246],{"type":20,"value":247},"Wrong:",{"type":15,"tag":144,"props":249,"children":251},{"code":250},"v=spf1 ip4:203.0.113.10 ~all\nv=spf1 include:smtp.infomaniak.com ~all\n",[252],{"type":15,"tag":116,"props":253,"children":254},{"__ignoreMap":7},[255],{"type":20,"value":250},{"type":15,"tag":16,"props":257,"children":258},{},[259],{"type":20,"value":260},"Right:",{"type":15,"tag":144,"props":262,"children":263},{"code":146},[264],{"type":15,"tag":116,"props":265,"children":266},{"__ignoreMap":7},[267],{"type":20,"value":146},{"type":15,"tag":16,"props":269,"children":270},{},[271],{"type":20,"value":272},"Merge all your sending sources into a single record. This is the most common SPF error, and it is entirely silent until you start checking your DMARC reports.",{"type":15,"tag":104,"props":274,"children":276},{"id":275},"the-all-qualifier",[277,279,285],{"type":20,"value":278},"The ",{"type":15,"tag":116,"props":280,"children":282},{"className":281},[],[283],{"type":20,"value":284},"all",{"type":20,"value":286}," Qualifier",{"type":15,"tag":158,"props":288,"children":289},{},[290,301,311],{"type":15,"tag":162,"props":291,"children":292},{},[293,299],{"type":15,"tag":116,"props":294,"children":296},{"className":295},[],[297],{"type":20,"value":298},"-all",{"type":20,"value":300}," (hardfail): reject messages from any unlisted source",{"type":15,"tag":162,"props":302,"children":303},{},[304,309],{"type":15,"tag":116,"props":305,"children":307},{"className":306},[],[308],{"type":20,"value":203},{"type":20,"value":310}," (softfail): accept but mark them suspicious",{"type":15,"tag":162,"props":312,"children":313},{},[314,320],{"type":15,"tag":116,"props":315,"children":317},{"className":316},[],[318],{"type":20,"value":319},"?all",{"type":20,"value":321}," (neutral): no opinion",{"type":15,"tag":16,"props":323,"children":324},{},[325,327,332,334,339],{"type":20,"value":326},"Start with ",{"type":15,"tag":116,"props":328,"children":330},{"className":329},[],[331],{"type":20,"value":203},{"type":20,"value":333}," while you confirm every legitimate sending source is listed. Once you are confident nothing is missing, switch to ",{"type":15,"tag":116,"props":335,"children":337},{"className":336},[],[338],{"type":20,"value":298},{"type":20,"value":55},{"type":15,"tag":23,"props":341,"children":343},{"id":342},"setting-up-dkim",[344],{"type":20,"value":345},"Setting Up DKIM",{"type":15,"tag":104,"props":347,"children":349},{"id":348},"how-dkim-works",[350],{"type":20,"value":351},"How DKIM Works",{"type":15,"tag":16,"props":353,"children":354},{},[355],{"type":20,"value":356},"DKIM uses asymmetric cryptography. Your sending server signs each outgoing message with a private key. The corresponding public key is published in DNS. The recipient's server fetches the public key and validates the signature on arrival.",{"type":15,"tag":104,"props":358,"children":360},{"id":359},"publishing-the-dkim-record",[361],{"type":20,"value":362},"Publishing the DKIM Record",{"type":15,"tag":16,"props":364,"children":365},{},[366],{"type":20,"value":367},"Your SMTP provider or email server generates the key pair and gives you the public key to publish. The DNS record:",{"type":15,"tag":144,"props":369,"children":371},{"code":370},"Type:  TXT\nName:  mail._domainkey.yourdomain.com\nValue: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...\n",[372],{"type":15,"tag":116,"props":373,"children":374},{"__ignoreMap":7},[375],{"type":20,"value":370},{"type":15,"tag":16,"props":377,"children":378},{},[379,380,386,388,393,395,401,403,409],{"type":20,"value":278},{"type":15,"tag":116,"props":381,"children":383},{"className":382},[],[384],{"type":20,"value":385},"mail",{"type":20,"value":387}," prefix is the selector -- a label that lets you run multiple DKIM keys or rotate them without interrupting delivery. Common selectors include ",{"type":15,"tag":116,"props":389,"children":391},{"className":390},[],[392],{"type":20,"value":385},{"type":20,"value":394},", ",{"type":15,"tag":116,"props":396,"children":398},{"className":397},[],[399],{"type":20,"value":400},"default",{"type":20,"value":402},", or a date string like ",{"type":15,"tag":116,"props":404,"children":406},{"className":405},[],[407],{"type":20,"value":408},"2026q3",{"type":20,"value":55},{"type":15,"tag":16,"props":411,"children":412},{},[413],{"type":20,"value":414},"Tag breakdown:",{"type":15,"tag":158,"props":416,"children":417},{},[418,429,440],{"type":15,"tag":162,"props":419,"children":420},{},[421,427],{"type":15,"tag":116,"props":422,"children":424},{"className":423},[],[425],{"type":20,"value":426},"v=DKIM1",{"type":20,"value":428}," -- version",{"type":15,"tag":162,"props":430,"children":431},{},[432,438],{"type":15,"tag":116,"props":433,"children":435},{"className":434},[],[436],{"type":20,"value":437},"k=rsa",{"type":20,"value":439}," -- key algorithm",{"type":15,"tag":162,"props":441,"children":442},{},[443,449],{"type":15,"tag":116,"props":444,"children":446},{"className":445},[],[447],{"type":20,"value":448},"p=...",{"type":20,"value":450}," -- Base64-encoded public key provided by your server",{"type":15,"tag":104,"props":452,"children":454},{"id":453},"key-length-and-rotation",[455],{"type":20,"value":456},"Key Length and Rotation",{"type":15,"tag":16,"props":458,"children":459},{},[460],{"type":20,"value":461},"Use a minimum key length of 2048 bits. Some older configurations still generate 1024-bit keys; check your provider's settings and request 2048 if necessary.",{"type":15,"tag":16,"props":463,"children":464},{},[465],{"type":20,"value":466},"Rotate keys periodically. Publish the new key under a new selector, update your server configuration, then wait a few days before removing the old selector to avoid failing messages still in transit.",{"type":15,"tag":23,"props":468,"children":470},{"id":469},"setting-up-dmarc",[471],{"type":20,"value":472},"Setting Up DMARC",{"type":15,"tag":104,"props":474,"children":476},{"id":475},"how-dmarc-works",[477],{"type":20,"value":478},"How DMARC Works",{"type":15,"tag":16,"props":480,"children":481},{},[482,484,490],{"type":20,"value":483},"DMARC evaluates the results of SPF and DKIM and applies a policy you control. For DMARC to pass, at least one of SPF or DKIM must also align with the domain in the visible ",{"type":15,"tag":116,"props":485,"children":487},{"className":486},[],[488],{"type":20,"value":489},"From",{"type":20,"value":491}," header -- not just any domain in the message headers.",{"type":15,"tag":104,"props":493,"children":495},{"id":494},"writing-your-dmarc-record",[496],{"type":20,"value":497},"Writing Your DMARC Record",{"type":15,"tag":144,"props":499,"children":501},{"code":500},"Type:  TXT\nName:  _dmarc.yourdomain.com\nValue: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1;\n",[502],{"type":15,"tag":116,"props":503,"children":504},{"__ignoreMap":7},[505],{"type":20,"value":500},{"type":15,"tag":16,"props":507,"children":508},{},[509],{"type":20,"value":414},{"type":15,"tag":158,"props":511,"children":512},{},[513,523,534,545],{"type":15,"tag":162,"props":514,"children":515},{},[516,522],{"type":15,"tag":116,"props":517,"children":519},{"className":518},[],[520],{"type":20,"value":521},"v=DMARC1",{"type":20,"value":428},{"type":15,"tag":162,"props":524,"children":525},{},[526,532],{"type":15,"tag":116,"props":527,"children":529},{"className":528},[],[530],{"type":20,"value":531},"p=none",{"type":20,"value":533}," -- policy (none, quarantine, or reject)",{"type":15,"tag":162,"props":535,"children":536},{},[537,543],{"type":15,"tag":116,"props":538,"children":540},{"className":539},[],[541],{"type":20,"value":542},"rua=mailto:...",{"type":20,"value":544}," -- destination for aggregate reports, sent daily",{"type":15,"tag":162,"props":546,"children":547},{},[548,554],{"type":15,"tag":116,"props":549,"children":551},{"className":550},[],[552],{"type":20,"value":553},"fo=1",{"type":20,"value":555}," -- generate a forensic report when either SPF or DKIM fails",{"type":15,"tag":104,"props":557,"children":559},{"id":558},"the-three-dmarc-policies",[560],{"type":20,"value":561},"The Three DMARC Policies",{"type":15,"tag":563,"props":564,"children":565},"table",{},[566,585],{"type":15,"tag":567,"props":568,"children":569},"thead",{},[570],{"type":15,"tag":571,"props":572,"children":573},"tr",{},[574,580],{"type":15,"tag":575,"props":576,"children":577},"th",{},[578],{"type":20,"value":579},"Policy",{"type":15,"tag":575,"props":581,"children":582},{},[583],{"type":20,"value":584},"What Happens",{"type":15,"tag":586,"props":587,"children":588},"tbody",{},[589,606,623],{"type":15,"tag":571,"props":590,"children":591},{},[592,601],{"type":15,"tag":593,"props":594,"children":595},"td",{},[596],{"type":15,"tag":116,"props":597,"children":599},{"className":598},[],[600],{"type":20,"value":531},{"type":15,"tag":593,"props":602,"children":603},{},[604],{"type":20,"value":605},"No action; reports are sent, messages are not filtered",{"type":15,"tag":571,"props":607,"children":608},{},[609,618],{"type":15,"tag":593,"props":610,"children":611},{},[612],{"type":15,"tag":116,"props":613,"children":615},{"className":614},[],[616],{"type":20,"value":617},"p=quarantine",{"type":15,"tag":593,"props":619,"children":620},{},[621],{"type":20,"value":622},"Failing messages go to the spam folder",{"type":15,"tag":571,"props":624,"children":625},{},[626,635],{"type":15,"tag":593,"props":627,"children":628},{},[629],{"type":15,"tag":116,"props":630,"children":632},{"className":631},[],[633],{"type":20,"value":634},"p=reject",{"type":15,"tag":593,"props":636,"children":637},{},[638],{"type":20,"value":639},"Failing messages are refused outright",{"type":15,"tag":104,"props":641,"children":643},{"id":642},"the-pnone-trap",[644],{"type":20,"value":645},"The p=none Trap",{"type":15,"tag":16,"props":647,"children":648},{},[649,654],{"type":15,"tag":116,"props":650,"children":652},{"className":651},[],[653],{"type":20,"value":531},{"type":20,"value":655}," is the right starting point. It lets you collect reports and discover which sources send on your domain's behalf without risking legitimate mail. The mistake is never moving past it.",{"type":15,"tag":16,"props":657,"children":658},{},[659,661,666],{"type":20,"value":660},"A domain stuck on ",{"type":15,"tag":116,"props":662,"children":664},{"className":663},[],[665],{"type":20,"value":531},{"type":20,"value":667}," for months offers no protection against spoofing. The intended progression:",{"type":15,"tag":669,"props":670,"children":671},"ol",{},[672,684,689,694,704],{"type":15,"tag":162,"props":673,"children":674},{},[675,677,682],{"type":20,"value":676},"Publish ",{"type":15,"tag":116,"props":678,"children":680},{"className":679},[],[681],{"type":20,"value":531},{"type":20,"value":683}," with a reporting address",{"type":15,"tag":162,"props":685,"children":686},{},[687],{"type":20,"value":688},"Read the aggregate reports for two to four weeks",{"type":15,"tag":162,"props":690,"children":691},{},[692],{"type":20,"value":693},"Confirm all legitimate senders appear in your SPF record and are signing with DKIM",{"type":15,"tag":162,"props":695,"children":696},{},[697,699],{"type":20,"value":698},"Move to ",{"type":15,"tag":116,"props":700,"children":702},{"className":701},[],[703],{"type":20,"value":617},{"type":15,"tag":162,"props":705,"children":706},{},[707,709],{"type":20,"value":708},"Once reports show no unexpected sources, move to ",{"type":15,"tag":116,"props":710,"children":712},{"className":711},[],[713],{"type":20,"value":634},{"type":15,"tag":16,"props":715,"children":716},{},[717,722],{"type":15,"tag":116,"props":718,"children":720},{"className":719},[],[721],{"type":20,"value":634},{"type":20,"value":723}," is when DMARC actually protects your domain. If you stop at step four, you have done most of the work for none of the security benefit.",{"type":15,"tag":16,"props":725,"children":726},{},[727,729,735,737,743],{"type":20,"value":728},"Correct authentication is also a prerequisite for any sending volume -- skipping it while you ",{"type":15,"tag":46,"props":730,"children":732},{"href":731},"/en/blog/how-to-warm-up-email-domain",[733],{"type":20,"value":734},"warm up a new email domain",{"type":20,"value":736}," means you are building reputation on a foundation that receiving servers will not trust. It is also one of the clearest paths onto an ",{"type":15,"tag":46,"props":738,"children":740},{"href":739},"/en/blog/how-to-avoid-email-blacklist-2",[741],{"type":20,"value":742},"email blacklist",{"type":20,"value":55},{"type":15,"tag":23,"props":745,"children":747},{"id":746},"verifying-your-records",[748],{"type":20,"value":749},"Verifying Your Records",{"type":15,"tag":16,"props":751,"children":752},{},[753],{"type":20,"value":754},"After publishing, DNS propagation can take up to 48 hours. Verify with standard DNS queries:",{"type":15,"tag":16,"props":756,"children":757},{},[758],{"type":20,"value":759},"For SPF:",{"type":15,"tag":144,"props":761,"children":765},{"code":762,"language":763,"meta":7,"className":764,"style":7},"dig TXT yourdomain.com\n","bash","language-bash shiki shiki-themes github-dark",[766],{"type":15,"tag":116,"props":767,"children":768},{"__ignoreMap":7},[769],{"type":15,"tag":770,"props":771,"children":774},"span",{"class":772,"line":773},"line",1,[775,781,787],{"type":15,"tag":770,"props":776,"children":778},{"style":777},"--shiki-default:#B392F0",[779],{"type":20,"value":780},"dig",{"type":15,"tag":770,"props":782,"children":784},{"style":783},"--shiki-default:#9ECBFF",[785],{"type":20,"value":786}," TXT",{"type":15,"tag":770,"props":788,"children":789},{"style":783},[790],{"type":20,"value":791}," yourdomain.com\n",{"type":15,"tag":16,"props":793,"children":794},{},[795,797,802],{"type":20,"value":796},"For DKIM (replace ",{"type":15,"tag":116,"props":798,"children":800},{"className":799},[],[801],{"type":20,"value":385},{"type":20,"value":803}," with your selector):",{"type":15,"tag":144,"props":805,"children":807},{"code":806,"language":763,"meta":7,"className":764,"style":7},"dig TXT mail._domainkey.yourdomain.com\n",[808],{"type":15,"tag":116,"props":809,"children":810},{"__ignoreMap":7},[811],{"type":15,"tag":770,"props":812,"children":813},{"class":772,"line":773},[814,818,822],{"type":15,"tag":770,"props":815,"children":816},{"style":777},[817],{"type":20,"value":780},{"type":15,"tag":770,"props":819,"children":820},{"style":783},[821],{"type":20,"value":786},{"type":15,"tag":770,"props":823,"children":824},{"style":783},[825],{"type":20,"value":826}," mail._domainkey.yourdomain.com\n",{"type":15,"tag":16,"props":828,"children":829},{},[830],{"type":20,"value":831},"For DMARC:",{"type":15,"tag":144,"props":833,"children":835},{"code":834,"language":763,"meta":7,"className":764,"style":7},"dig TXT _dmarc.yourdomain.com\n",[836],{"type":15,"tag":116,"props":837,"children":838},{"__ignoreMap":7},[839],{"type":15,"tag":770,"props":840,"children":841},{"class":772,"line":773},[842,846,850],{"type":15,"tag":770,"props":843,"children":844},{"style":777},[845],{"type":20,"value":780},{"type":15,"tag":770,"props":847,"children":848},{"style":783},[849],{"type":20,"value":786},{"type":15,"tag":770,"props":851,"children":852},{"style":783},[853],{"type":20,"value":854}," _dmarc.yourdomain.com\n",{"type":15,"tag":16,"props":856,"children":857},{},[858,860,867],{"type":20,"value":859},"If the record is missing, wait and retry. If it appears but authentication still fails, check that your sending server is actually applying the DKIM signature and sending from a listed IP. Google documents the expected record formats in its ",{"type":15,"tag":46,"props":861,"children":864},{"href":862,"rel":863},"https://support.google.com/a/answer/33786",[50],[865],{"type":20,"value":866},"sender authentication guide",{"type":20,"value":55},{"type":15,"tag":23,"props":869,"children":871},{"id":870},"how-this-applies-in-fluenzr",[872],{"type":20,"value":873},"How This Applies in Fluenzr",{"type":15,"tag":16,"props":875,"children":876},{},[877],{"type":20,"value":878},"Fluenzr supports SMTP (OVH, Infomaniak, and any standard SMTP provider), Gmail OAuth, and Microsoft accounts. When you connect via SMTP, Fluenzr sends through your provider's infrastructure. Your SPF record must cover your provider's IP range, and your DKIM key must be generated through your provider's settings -- Fluenzr does not touch your DNS.",{"type":15,"tag":16,"props":880,"children":881},{},[882,884,890],{"type":20,"value":883},"This means you keep full ownership of your domain's reputation. See the ",{"type":15,"tag":46,"props":885,"children":887},{"href":886},"/en/features/",[888],{"type":20,"value":889},"features page",{"type":20,"value":891}," for details on how sending accounts and infrastructure are managed.",{"type":15,"tag":893,"props":894,"children":895},"hr",{},[],{"type":15,"tag":23,"props":897,"children":899},{"id":898},"key-takeaways",[900],{"type":20,"value":901},"Key Takeaways",{"type":15,"tag":158,"props":903,"children":904},{},[905,910,915,920,945,950,962],{"type":15,"tag":162,"props":906,"children":907},{},[908],{"type":20,"value":909},"SPF, DKIM, and DMARC each solve a different authentication problem; all three are required for the system to work.",{"type":15,"tag":162,"props":911,"children":912},{},[913],{"type":20,"value":914},"Publish exactly one SPF TXT record per domain -- a second record silently breaks both.",{"type":15,"tag":162,"props":916,"children":917},{},[918],{"type":20,"value":919},"Use a 2048-bit DKIM key minimum and rotate it periodically using a new selector.",{"type":15,"tag":162,"props":921,"children":922},{},[923,925,930,932,937,939,944],{"type":20,"value":924},"Start DMARC at ",{"type":15,"tag":116,"props":926,"children":928},{"className":927},[],[929],{"type":20,"value":531},{"type":20,"value":931}," to collect reports, then advance to ",{"type":15,"tag":116,"props":933,"children":935},{"className":934},[],[936],{"type":20,"value":617},{"type":20,"value":938}," and then ",{"type":15,"tag":116,"props":940,"children":942},{"className":941},[],[943],{"type":20,"value":634},{"type":20,"value":55},{"type":15,"tag":162,"props":946,"children":947},{},[948],{"type":20,"value":949},"DMARC reports reveal every source sending on your domain's behalf -- read them before changing policy.",{"type":15,"tag":162,"props":951,"children":952},{},[953,955,960],{"type":20,"value":954},"Verify all three records with ",{"type":15,"tag":116,"props":956,"children":958},{"className":957},[],[959],{"type":20,"value":780},{"type":20,"value":961}," after any DNS change.",{"type":15,"tag":162,"props":963,"children":964},{},[965],{"type":20,"value":966},"Correct authentication is a prerequisite for effective warming and long-term deliverability.",{"type":15,"tag":893,"props":968,"children":969},{},[],{"type":15,"tag":16,"props":971,"children":972},{},[973,975,982,984,989],{"type":20,"value":974},"Ready to send from a properly authenticated domain? ",{"type":15,"tag":46,"props":976,"children":979},{"href":977,"rel":978},"https://app.fluenzr.co/signup",[50],[980],{"type":20,"value":981},"Create a free account on Fluenzr",{"type":20,"value":983}," and connect your SMTP server in minutes. If you are ready to go paid, the code ",{"type":15,"tag":38,"props":985,"children":986},{},[987],{"type":20,"value":988},"FOUNDING50",{"type":20,"value":990}," gives you 50% off any plan for life -- reserved for the first 50 paying customers.",{"type":15,"tag":992,"props":993,"children":994},"style",{},[995],{"type":20,"value":996},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":998,"depth":998,"links":999},3,[1000,1002,1009,1014,1020,1021,1022],{"id":25,"depth":1001,"text":28},2,{"id":99,"depth":1001,"text":102,"children":1003},[1004,1005,1006,1007],{"id":106,"depth":998,"text":109},{"id":134,"depth":998,"text":137},{"id":229,"depth":998,"text":232},{"id":275,"depth":998,"text":1008},"The all Qualifier",{"id":342,"depth":1001,"text":345,"children":1010},[1011,1012,1013],{"id":348,"depth":998,"text":351},{"id":359,"depth":998,"text":362},{"id":453,"depth":998,"text":456},{"id":469,"depth":1001,"text":472,"children":1015},[1016,1017,1018,1019],{"id":475,"depth":998,"text":478},{"id":494,"depth":998,"text":497},{"id":558,"depth":998,"text":561},{"id":642,"depth":998,"text":645},{"id":746,"depth":1001,"text":749},{"id":870,"depth":1001,"text":873},{"id":898,"depth":1001,"text":901},"markdown","content:en:blog:spf-dkim-dmarc-configuration.md","content","en/blog/spf-dkim-dmarc-configuration.md","en/blog/spf-dkim-dmarc-configuration","md",[1030,1035,1039],{"_path":1031,"title":1032,"date":1033,"score":1034},"/en/blog/exigences-google-yahoo-expediteurs","Google & Yahoo Sender Requirements: SMB Guide","2026-08-25",0,{"_path":1036,"title":1037,"date":1038,"score":1034},"/en/blog/cold-email-rgpd-france","Cold Email in France: GDPR and CNIL Rules Explained","2026-08-21",{"_path":1040,"title":1041,"date":1038,"score":1034},"/en/blog/delivrabilite-smtp-ovh-infomaniak","OVH and Infomaniak SMTP: Email Deliverability Step by Step",1787814416926]