DKIM, SPF, and DMARC

What each one does

• SPF - a DNS TXT record listing the IP addresses and services permitted to send for the domain. The receiver checks the sending server against that list. SPF alone breaks on forwarding and doesn't sign content.
• DKIM - the sender signs the message with a private key; the matching public key is published in DNS. The receiver verifies the signature, confirming the message is unmodified and tied to the domain. DKIM survives forwarding better than SPF.
• DMARC - a DNS policy (none, quarantine, or reject) that applies only when SPF and/or DKIM align with the From: domain the recipient sees. It tells receivers how to treat failures and sends aggregate reports back to the domain owner, closing the gap that SPF and DKIM leave open individually.

Used together, the three are what modern inbox providers expect before they will trust - and reliably deliver - mail from a domain.

How Sairaph Mail handles authentication

• On a managed domain, DKIM signing, SPF, and DMARC are configured for you - there are no DNS records to set up by hand to start sending.
• On your own (bring-your-own) domain, you add the DNS records we provide and we verify them before the domain goes live, so your agent's mail is properly authenticated under your own domain.

Authentication improves the odds of good placement, but no provider can honestly *guarantee* inbox placement - deliverability also depends on sending reputation and recipient-side rules.

Related terms

• [Programmatic mailbox](/glossary/programmatic-mailbox) - the authenticated inbox these records back.
• [Two-way email API](/glossary/two-way-email-api) - sends from a domain authenticated with DKIM/SPF/DMARC.
• See the product page for managed-domain details and the security page for the deliverability stance.