SPF, DKIM, and DMARC

Email authentication is the process of proving that an email was actually sent by the domain it claims to come from. Three complementary standards work together to prevent email spoofing and phishing: SPF (who can send), DKIM (message integrity), and DMARC (policy and reporting).

AgentPost configures SPF and DKIM automatically when you add a custom domain. This guide explains how each standard works so you can verify your configuration, troubleshoot issues, and set up DMARC.

SPF: Sender Policy Framework

SPF lets domain owners specify which mail servers are authorized to send email on behalf of their domain. Receiving mail servers check the SPF record to verify that the sending server is allowed.

How SPF Works

1. Your agent sends an email from [email protected] through AgentPost (which uses AWS SES)
2. The recipient's mail server looks up the SPF DNS record for acmeco.com
3. The SPF record lists authorized sending servers (including SES)
4. If the sending server's IP matches, SPF passes; otherwise, it fails

DNS Record Format

SPF records are published as DNS TXT records on your domain:

v=spf1 include:amazonses.com ~all

Include mechanism: The include: directive delegates SPF validation to another domain's SPF record. include:amazonses.com adds all AWS SES sending IPs to your authorized list.

AgentPost Setup

When you add a custom domain in AgentPost, the domain verification process provides the exact SPF record to add. If you already have an SPF record, add the include:amazonses.com directive to your existing record:

# Before (existing SPF record)
v=spf1 include:_spf.google.com ~all

# After (with AgentPost/SES added)
v=spf1 include:_spf.google.com include:amazonses.com ~all

Important: You can only have one SPF record per domain. Multiple SPF records cause validation failures. Merge all include: directives into a single record.

SPF Lookup Limit

SPF has a maximum of 10 DNS lookups per evaluation. Each include:, a:, mx:, and redirect: counts as one lookup. If your SPF record exceeds this limit, SPF validation fails entirely.

If you are hitting the lookup limit, consider using SPF flattening tools that resolve include: directives to IP addresses.

DKIM: DomainKeys Identified Mail

DKIM uses public-key cryptography to sign outgoing emails. The receiving server verifies the signature against the public key published in DNS, confirming that the email was not modified in transit and was sent by an authorized system.

How DKIM Works

1. AgentPost (via SES) signs your outgoing email with a private key
2. The signature is added as a DKIM-Signature header on the email
3. The recipient's mail server looks up the DKIM public key from your domain's DNS
4. The server verifies the signature against the email content
5. If the signature is valid, DKIM passes

DNS Record Format

DKIM uses CNAME records that point to AWS SES's DKIM key servers:

selector1._domainkey.acmeco.com  CNAME  selector1-acmeco-com.dkim.amazonses.com
selector2._domainkey.acmeco.com  CNAME  selector2-acmeco-com.dkim.amazonses.com
selector3._domainkey.acmeco.com  CNAME  selector3-acmeco-com.dkim.amazonses.com

SES uses three DKIM selectors for key rotation. When SES rotates keys, the CNAME records automatically resolve to the new public keys.

AgentPost Setup

When you add a custom domain, AgentPost provides the three DKIM CNAME records to add to your DNS. The domain verification process validates that all three records are properly configured.

# Verify DKIM records are in place
dig selector1._domainkey.acmeco.com CNAME +short
# Expected: selector1-acmeco-com.dkim.amazonses.com

What DKIM Signs

The DKIM signature covers specific email headers and the body:

• From, To, Subject headers
• Date, Message-ID headers
• Email body content

If any of these are modified after signing (e.g., by a mailing list manager), DKIM verification fails. This is expected behavior -- it means the message was altered.

DMARC: Domain-based Message Authentication, Reporting, and Conformance

DMARC builds on SPF and DKIM to give domain owners control over what happens when authentication fails. It also provides reporting so you can monitor authentication results.

How DMARC Works

1. The recipient's mail server checks SPF and DKIM results
2. It then looks up the DMARC record for the sender's domain
3. DMARC checks alignment: does the SPF/DKIM authenticated domain match the From: header domain?
4. Based on the DMARC policy, the server decides to deliver, quarantine, or reject the message
5. The server sends aggregate reports to the address specified in the DMARC record

Alignment Modes

DMARC requires that the domain authenticated by SPF or DKIM aligns with the domain in the From: header. There are two alignment modes:

Recommendation: Use relaxed alignment (the default) unless you have a specific reason for strict. Relaxed alignment allows subdomains like mail.acmeco.com to pass when the organizational domain acmeco.com is authenticated.

Policy Options

DNS Record Format

DMARC records are published as TXT records on _dmarc.yourdomain.com:

# Start with monitoring only (recommended)
v=DMARC1; p=none; rua=mailto:[email protected]; pct=100

# After monitoring confirms everything works, upgrade to quarantine
v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100

# Full enforcement (ultimate goal)
v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100

Recommended Rollout

1. Week 1-2: Deploy p=none and monitor aggregate reports
2. Week 3-4: Review reports, fix any authentication issues
3. Week 5-6: Move to p=quarantine (failing messages go to spam)
4. Week 7+: Move to p=reject once you're confident all legitimate mail passes

DMARC Reports

DMARC aggregate reports are XML files sent daily by receiving mail servers to the address in your rua tag. They contain:

• Volume of messages seen from your domain
• SPF and DKIM pass/fail counts
• Which IP addresses sent mail claiming to be from your domain
• Alignment results

Use a DMARC report analyzer (many free services exist) to parse these XML reports into readable dashboards.

Verifying Your Configuration

After setting up all DNS records, verify them through the AgentPost API or command line:

# Check SPF
dig acmeco.com TXT +short | grep spf
# Expected: "v=spf1 include:amazonses.com ~all"

# Check DKIM
dig selector1._domainkey.acmeco.com CNAME +short
# Expected: selector1-acmeco-com.dkim.amazonses.com

# Check DMARC
dig _dmarc.acmeco.com TXT +short
# Expected: "v=DMARC1; p=none; rua=mailto:[email protected]"

AgentPost's domain verification automatically checks SPF and DKIM. When all checks pass, the domain status changes to verified and a domain.verified webhook event is emitted.

Common Issues