Securing Email Communications: SPF, DKIM, and DMARC Setup

Just a quick write-up/reference document today on email security, particularly in light of the increasing threats from spoofing and phishing attempts. With Google and Yahoo's upcoming requirement for DMARC implementation starting February 2024, it's important to ensure our organization's email communications are properly secured so that we can avoid getting flagged and sent straight to spam.

Setting up SPF (Sender Policy Framework)

  1. Access the DNS records for our domain
  2. Create a new TXT record
  3. Input the SPF record details
  4. Set the TTL to one hour

Important: Include every possible mail source or SMTP server sending valid mail for our domain in the SPF record.

Basic SPF syntax: v=spf1 <valid mail sources> <enforcement rule>

Example:

v=spf1 ip4:192.168.0.10 ip4:192.168.0.12 include:spf.protection.outlook.com -all

Implementing DKIM (DomainKeys Identified Mail)

  1. Access the DNS records for our domain
  2. Obtain CNAME record information from our mail provider
  3. If using Office 365, enable DKIM to receive DNS record data

Example DKIM CNAME records for Microsoft 365:

  • Hostname: selector1._domainkey Points to: selector1-<CustomDomain>._domainkey.<InitialDomain>
  • Hostname: selector2._domainkey Points to: selector2-<CustomDomain>._domainkey.<InitialDomain>

Configuring DMARC (Domain-based Message Authentication, Reporting, and Conformance)

  1. Access the DNS records for our domain
  2. Set up DMARC TXT records in DNS
  3. Use the following basic syntax:
    • Hostname: _dmarc
    • TXT Value: v=DMARC1; p=reject; pct=100; rua=mailto:rua@contoso.com; ruf=mailto:ruf@contoso.com

Final Steps

After setting up all records, double check the configuration and run some tests:

  1. Use a tool like MxToolbox to verify correct record configuration
  2. Conduct a real-world test by sending emails to and from an external address

All example values were pulled form various Learn Microsoft documents.