Email authentication
How DKIM, SPF, and DMARC work
DKIM, SPF, and DMARC are three DNS records every sending domain needs. Together they prove that a message came from you, stop forgers from sending mail on your behalf, and tell receiving servers what to do when verification fails. This guide explains each one plainly, in the order you should set them up.
When a message arrives at Gmail or Outlook, the receiving server runs three checks before deciding whether to deliver it. Getting all three right is what separates a domain that lands in the inbox from one that ends up in spam — or gets silently rejected.
SPF — who is allowed to send from your domain
An SPF record is a DNS TXT record on your domain that lists the IP addresses and mail services permitted to send on your behalf. When a receiving server gets a message that claims to be from you, it looks up your SPF record and checks whether the sending server is on the list. If it is not, the message fails SPF. Add one SPF record per domain; multiple records are invalid. Rovela's setup page shows the exact value to add.
DKIM — a cryptographic signature on every message
DKIM adds a signature to each outgoing message using a private key held by the sending service. You publish the corresponding public key as a DNS TXT record. The receiving server fetches the public key and verifies the signature. A valid signature means the message body and headers have not been tampered with since signing, and that the key's owner authorized the send. Once you add the TXT record Rovela shows in your domain settings, every outgoing message is automatically signed.
DMARC — what to do when checks fail
DMARC is a policy record. It tells receiving servers what to do with messages that fail SPF or DKIM: nothing (p=none, for monitoring), quarantine them to spam, or reject them outright. It also names an address where failure reports should be sent, so you can see who is trying to forge your domain. Start with p=none to collect data, then move to p=quarantine and eventually p=reject once you are confident all legitimate sending sources are aligned.
Alignment — why all three need to point at the same domain
DMARC requires alignment: the domain in the From header must match the domain that passed SPF or the domain in the DKIM signature. A message can pass SPF on the envelope sender and still fail DMARC if the envelope domain is different from the From domain. Rovela sends from your domain rather than its own, so DKIM and SPF both align with the address your recipients see.
The order that works
Add SPF first, then DKIM, then DMARC at p=none. Verify that legitimate mail is passing both checks using the reports DMARC sends you. Once all sources are aligned, step the policy up to p=quarantine for a week, then p=reject. Trying to jump straight to p=reject without monitoring first regularly breaks transactional mail from services that send on your behalf.
Common questions
- Do I need all three records, or will just one do?
- You need all three for full protection. SPF and DKIM authenticate the send; DMARC tells receivers what to do when authentication fails and gives you visibility into who is sending from your domain. A domain with only SPF is still vulnerable to DMARC-failing spoofs.
- Can I rotate my DKIM key without downtime?
- Yes. Start a rotation in the dashboard and Rovela generates a new key under a new selector, shown as a second TXT record to publish alongside the existing one. The new key starts signing only after you verify the domain and Rovela confirms the record resolves, so mail is never signed with a key receivers cannot fetch. The old record keeps validating messages signed before the switch.
- Can I have SPF records for multiple sending services?
- Yes, but only one SPF record per domain. You combine all permitted senders into a single TXT record using include: mechanisms. Adding a second separate SPF record is a protocol error and causes unpredictable failures.
- How do I know if my records are set up correctly?
- Rovela's dashboard verifies your DKIM and SPF records and shows a green check when they resolve correctly. You can also send a test message to a Gmail address and view the original message source — it shows the authentication results for each check.