D-02 · AUTHENTICATION · SPF DKIM DMARC
SPF, DKIM, DMARC setup checklist that actually passes
Most authentication failures are alignment failures, not missing records. This checklist walks subdomain strategy, record verification, and staged DMARC enforcement.
Symptom
A team adds SPF and DKIM records, sees “pass” in a tester, then publishes DMARC with p=reject — and legitimate mail starts failing. Invoices go to spam, the CEO’s forwarded receipts bounce, and a third-party scheduler’s sends get rejected. The records exist, but the identifiers do not align: the envelope-from differs from the header-from, DKIM signs a different domain than the visible sender, and forwarded mail breaks SPF while DMARC demands alignment survivors must evaluate.
The second symptom is invisible: no DMARC reports are collected, so nobody knows which legitimate streams fail. Enforcement without reporting is flying blind, and the first sign of trouble is a customer complaint rather than an aggregate report trend.
Cause
SPF validates the envelope-from domain against the sending IP; DKIM validates a cryptographic signature tied to a signing domain; DMARC requires at least one of them to align with the header-from domain users see. Common breaks: marketing vendors sending from their own envelope domain without custom return-path (SPF never aligns), DKIM selectors signed for the vendor’s domain instead of yours, multiple SPF includes exceeding the 10-DNS-lookup limit, and mailing-list forwarders rewriting nothing while SPF breaks on forward.
Subdomain strategy is the root fix most teams skip. Sending product mail from the apex domain mixes marketing, transactional, and employee correspondence into one reputation and one DMARC policy. A strict policy that suits transactional then strangles legitimate third-party flows, or a lax policy kept for compatibility leaves phishing unblocked.
Fix
First, segment by subdomain: transactional on one subdomain, marketing on another, corporate mail on the apex. Each gets its own SPF, DKIM selectors, and return-path. Configure custom return-path and DKIM signing in every vendor so both mechanisms can align with your header-from — verify in vendor dashboards, not just DNS. Flatten SPF includes if lookups exceed limits, and remove stale vendor entries from decommissioned tools.
Stage DMARC: publish p=none with rua reporting to a monitored mailbox for two to four weeks. Parse aggregate reports to inventory every legitimate sender, fix alignment per stream, then move to p=quarantine at low percentage, escalating to full quarantine and finally reject. Each stage needs a full reporting cycle before the next step.
Prevention
Maintain a sender inventory: every vendor, subdomain, selector, and include, reviewed quarterly. Alert on new SPF lookup counts and unauthorized DKIM selectors. Keep DMARC reports parsed automatically with weekly review, and require any new email vendor to document return-path and DKIM alignment before first send. Test with seed mailboxes at major providers after every DNS change, and keep TTLs short during migrations.