SPF, DKIM & DMARC DNS Planning Guide

### Conceptual Architecture Blueprint #### 1. SPF (Sender Policy Framework - RFC 7208) - **Syntax:** `v=spf1 include:_spf.google.com include:mailgun.org ~all` - **Crucial Rule:** Exactly ONE SPF record per domain. Never publish two separate TXT records starting with `v=spf1`. - **The 10-Lookup Limit:** RFC 7208 limits recursive DNS lookups to 10. Exceeding 10 causes permanent SPF PermError. #### 2. DKIM (DomainKeys Identified Mail - RFC 6376) - **How It Works:** Cryptographic keypair. Private key signs outbound email headers; public key is published in DNS. - **DNS Record:** TXT record published at `selector._domainkey.yourdomain.com`. - **Standard:** Use 2048-bit RSA keys. Rotate selectors annually for enterprise security. #### 3. DMARC (Domain-based Message Authentication - RFC 7489) - **Staged Rollout Plan:** - **Phase 1 (Monitoring):** `v=DMARC1; p=none; rua=mailto:[email protected]; pct=100` (Run for 30–60 days). - **Phase 2 (Quarantine):** `v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100` (Run for 30 days). - **Phase 3 (Full Rejection):** `v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100` (Full protection against spoofing).