Technical
SPF, DKIM and DMARC alignment decoded, with the exact records to publish
8 January 2026 · 11 min read
Most authentication failures are not failures of SPF or DKIM. They are failures of alignment — the rule in RFC 7489 that says the domain a recipient sees must be the domain that authentication proved.
This article explains the three records, what each one actually verifies, and how alignment ties them together.
What each record verifies
| Mechanism | Record type | What it proves | Survives forwarding? |
|---|---|---|---|
| SPF | TXT on the domain | The sending server is authorised for the envelope sender | No — the envelope changes |
| DKIM | TXT at selector._domainkey | The message content and headers were signed by the domain | Usually yes |
| DMARC | TXT at _dmarc | An aligned SPF or DKIM identifier matched the From domain | Depends on DKIM surviving |
Strict versus relaxed alignment
DMARC has two alignment modes, set independently for SPF (aspf) and DKIM (adkim). Relaxed, the default, accepts an organisational-domain match: mail.example.com aligns with example.com. Strict requires an exact match.
Relaxed alignment is the right default for almost every marketing programme, because it lets you send from a dedicated subdomain while keeping the brand domain in the From address.
The records, in order of deployment
- SPF: a single TXT record on the sending domain, containing one include for your sending platform and ending in ~all. Never publish two SPF records — that is a permanent error.
- DKIM: the CNAME or TXT records your platform issues, published at the selector host it specifies. Each key gets its own host.
- DMARC: a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:reports@yourdomain.com; pct=100.
Moving from p=none to enforcement
p=none publishes a policy and collects reports without affecting delivery. Read four to six weeks of aggregate reports first, until every legitimate sending source appears as aligned and passing. Then move to p=quarantine with pct=25, raise the percentage in steps, and only then consider p=reject.
Rushing to p=reject before the reports are clean is how organisations discover their invoicing system, their help desk and their recruiting tool were all sending as the brand domain.
The host-name mistake that breaks half of all setups
Most DNS control panels append the domain to whatever you type in the Host field. Pasting the full hostname there produces selector._domainkey.example.com.example.com, which resolves to nothing. Enter only the prefix — selector._domainkey or _dmarc — and leave the value exactly as issued.
Key takeaways
- DMARC tests alignment, so authentication that passes in isolation can still fail.
- Relaxed alignment lets a subdomain send on behalf of the brand domain; strict does not.
- Publish exactly one SPF record, one DKIM host per key, and one _dmarc record.
- Spend four to six weeks at p=none reading reports before enforcing anything.
Sources
Put this into practice with HTsend
Everything in this guide is built into the platform: authenticate a sending domain, clean your list before you send, and watch inbox placement in real time.
