How to Setup Dmarc, SPF, and DKIM for your Email Domain?

Vlad is a passionate writer and link builder. Managing brand partnerships at Respona is his current passion. Having started writing articles at the age of 13, his once past-time hobby developed into a central piece of their professional life. 8 minute read

Email is an indispensable tool for every business, providing a professional and efficient channel for communication.

With an estimated 319.6 billion emails sent daily in 2021, the credibility and security of these digital exchanges have never been more critical, especially for Salesforce users who rely heavily on this platform for customer relationship management.

This is where DMARC, SPF, and DKIM come into play.

What Are DMARC, SPF, and DKIM?

DMARC stands for Domain-based Message Authentication, Reporting & Conformance.

It’s an email authentication protocol that uses SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to detect and mitigate email spoofing, a technique often used in phishing and email spam.

When setting up DMARC, you establish a policy outlining how your emails should be handled.

SPF (Sender Policy Framework) is another email authentication method that detects forging sender addresses during email delivery.

SPF allows the receiving mail server to check during mail delivery that mail claiming to come from a specific domain comes from an IP address authorized by that domain’s administrators.

On the other hand, DKIM (DomainKeys Identified Mail) is a means of verifying incoming email. It ensures that the messages weren’t altered during transit, affirms that they were actually sent from your domain, and adds an encrypted signature to your outgoing emails.

This way, recipients can check the DKIM signature to verify that the email wasn’t tampered with during transmission.

In terms of how these work, DMARC, SPF, and DKIM all function uniquely. However, they share a common goal: to validate an email sender’s identity and ensure the content’s integrity.

When a receiver’s email server gets an email, it checks the SPF record to verify that the email comes from a listed server. It accepts the email if it finds out that the server is listed. If the server is not listed, then it performs a DKIM check.

For the DKIM check, the receiver’s server uses the DKIM record to find a public cryptographic key to decode the email’s DKIM signature. If it manages to decode this signature, it defines the email as trustworthy.

If both the SPF and DKIM checks fail, a DMARC policy check happens. If the DMARC validation also fails, then, based on the DMARC policy that you’ve set, the email will either be accepted, quarantined, or rejected.

These three email authentication protocols add a layer of trust and verification, ensuring that your emails reach the intended recipient without being flagged as spam or malicious.

These processes can be game changers, especially for Salesforce users who handle large amounts of sensitive customer data.

The Importance of these Protocols for Salesforce Users

Now that we’ve discussed DMARC, SPF, and DKIM, you might still wonder why these protocols are pivotal for Salesforce users. Let’s peel back the veil.

1. Brand Protection: Email phishing scams can significantly tarnish your brand reputation. If imposters send malicious emails under your brand’s name, it can result in a breach of trust, leading to customer churn and potential business loss. Implementing DMARC, SPF, and DKIM ensures that your emails are secure and genuine, which helps protect your reputation.

2. EmailDeliverability: If you send emails from Salesforce without proper authentication with DMARC, SPF, and DKIM, there’s a higher risk of your emails ending in spam folders. This means your critical business communications may go unnoticed. These three protocols vouch for the legitimacy of your emails, ensuring improved email deliverability.

3. Building Trust in Communications: Salesforce users often send large amounts of sensitive data via email, such as invoices, contracts, and personal data. Using DMARC, SPF, and DKIM helps guarantee your customers that these messages are genuine, fostering a climate of trust.

4. Regulatory Compliance: In specific industries, implementing security measures to protect personal data is not just good practice; it’s the law. Laws such as GDPR, CCPA, TCPA, and others require companies to take reasonable steps to protect personal data, which includes email communications. For instance, a healthcare organization must always use HIPAA compliant tools when handling personal medical data to protect sensitive information from unauthorized access or breaches.

5. Business Insights: Authenticating your emails can also provide valuable insights. DMARC reports give visibility into who is sending emails on your behalf and how much of your email is authenticated. This can help you identify trends, spot potential issues, and even optimize marketing efforts based on data.

Setting Up DMARC

Setting up DMARC may sound technical, but the process is relatively straightforward. Here is a step-by-step guide to help you through it:

1. Understand DMARC Policy: Before setting up DMARC, knowing the existing policy levels is essential. You have ‘none’, ‘quarantine’ and ‘reject’. ‘None’ monitors email flow, ‘quarantine’ isolates emails failing DMARC, while ‘reject’ denies them. Many businesses start with ‘none’ to monitor their emails without affecting their flow and move to ‘quarantine’ or ‘reject’ once they are satisfied with the setup.

2. Create a DMARC Record: The next step is generating a DMARC record, a specific TXT record added to your domain’s DNS records. You can use various online tools to help generate this record. You’ll need to specify your policy preference (‘none’, ‘quarantine’, or ‘reject’), a reporting email address, and other settings.

3. Publish your DMARC record: After creating your DMARC record, add it to your domain’s DNS record. The record is added as a TXT record, with ‘_dmarc’ as your subdomain. For instance, if your domain is ‘yourdomain.com’, your DMARC record should be published on ‘_dmarc.yourdomain.com’.

4. Monitor and Adjust: Once your DMARC record is live, you will receive DMARC reports at the email address specified in your record. Monitor these carefully, as they provide insights on who is sending emails on your behalf, whether they are passing DMARC checks, and more. Based on this data, you will want to fine-tune your DMARC setup, potentially adjusting your prescribed DMARC policy from ‘none’ to ‘quarantine’ or ‘reject’ based on your observations.

Setting Up SPF

Here are the step-by-step instructions for setting up SPF:

1. Identify the IP addresses that Send Emails on your Behalf: First, you need to identify all the IP addresses that send emails on behalf of your domain. This would typically include your company’s email server and could also include third-party providers like Salesforce.

2. Create the SPF Record: After identifying the IPs, you can compile your SPF record, a type of DNS TXT record. In this record, you will define these mail servers as authorized senders.

For example, a simple SPF record could look like: “v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all. “This record shows that IP addresses within the 192.0.2.0/24 and 198.51.100.123 ranges are allowed, and no others are authorized (-all). If Salesforce sends emails on your behalf, you would also include their include: statement in your record.

3. Add the SPF Record to your DNS: The next step is to add the SPF record to your domain’s DNS as a TXT record. Depending on how your DNS has been managed, this action might be performed via your domain registrar or your company’s DNS manager interface.

4. Evaluate and Monitor: Setting up SPF is not a “set and forget” thing but a dynamic process requiring constant monitoring and occasional adjustment. Regularly examine your SPF record to ensure it remains up-to-date with your company’s list of authorized senders.

How to Set Up DKIM

Last but not least, let’s walk through the process of setting up DKIM:

1. Generate a DKIM Key pair: The DKIM key pair consists of private and public keys. The outbound email server uses the private key to sign all outgoing messages. The public key will be added to your domain’s DNS records, which will help the receiver verify the signature.

2. Add the public key to your DNS Records: After generating the key pair, you’ll need to add the public key to your DNS records as a TXT record. This allows the receiver’s server to look up and retrieve the key for verification.

3. Configure your Email Server: This step involves instructing your email server to sign outgoing emails using the private key. For Salesforce users, this can be done within Salesforce Email Administration settings under DKIM keys.

4. Testing and Verification: You should conduct tests to ensure your emails are correctly signed with DKIM and the public key is correctly published in your domain’s DNS record. You can use online DKIM testing tools to verify this.

Wrapping Up

In conclusion, implementing DMARC, SPF, and DKIM for your email domain might seem like an uphill climb, especially if you are unfamiliar with the technical aspects.

However, the process becomes quite manageable with the proper guidance and patience.

For Salesforce users, validating these protocols is an investment in their brand’s reputation, email deliverability, and communication trustworthiness, which will pay dividends in the long run.