SPF, DKIM, and DMARC explained

Authentication records tell inbox providers your mail is legitimate. Agencies publish them at the client’s DNS host — EonMailer shows provider-specific values.

SPF

Purpose: List which servers may send mail for a domain.

Format: Single TXT record:

v=spf1 include:amazonses.com include:sendgrid.net ~all

Rules:

1. One SPF TXT per hostname — merge includes.
2. Keep under 10 DNS lookups total in SPF chain.
3. Start with ~all (softfail); avoid +all.

Provider	Common include
Amazon SES	include:amazonses.com
SendGrid	include:sendgrid.net
Mailgun	include:mailgun.org

DKIM

Purpose: Cryptographic signature proving message wasn’t altered.

Usually CNAME records like:

selector._domainkey.mail.client.com → provider-hosted key

• Publish all selectors EonMailer/provider show (often 2–3 CNAMEs).
• Don’t orange-cloud proxy DKIM CNAMEs on Cloudflare unless docs allow.

DMARC

Purpose: Policy when SPF/DKIM alignment fails + reporting.

TXT at _dmarc.client.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@agency.com; fo=1

Progression:

1. p=none — monitor only (launch phase)
2. p=quarantine — after stable pass rates
3. p=reject — when confident (coordinate with client IT)

Warning Jumping straight to p=reject without aligned SPF/DKIM can block legitimate mail.

Alignment

Gmail checks that From domain aligns with SPF or DKIM domain. Send from @mail.client.com when that subdomain is authenticated.

Verification workflow

1. Publish records
2. Wait for propagation
3. Verify in EonMailer domain panel
4. Send test → Gmail Show original → look for spf=pass, dkim=pass, dmarc=pass

Provider-specific docs

• SES: Easy DKIM in SES console + SPF include
• SendGrid: Domain authentication wizard
• Mailgun: Domain DNS tab

See also DNS overview.