SPF / DMARC / DKIM

Configure your domain's DNS records to protect against sender spoofing and improve deliverability.

After changing your MX records, be sure to update SPF — otherwise mail from your domain may be marked as spam by recipients.

SPF

SPF (Sender Policy Framework) specifies which servers are allowed to send mail on behalf of your domain. Add a TXT record to your DNS zone:

TXT record for your domain

v=spf1 mx include:spf.mxguard.net ~all

If you also send mail directly from your own server or through other services, add them too:

v=spf1 mx ip4:1.2.3.4 include:spf.mxguard.net ~all

Mechanism	Meaning
`mx`	Allow sending from the servers listed in the domain's MX records
`include:spf.mxguard.net`	Allow MXGuard's infrastructure IPs (for outbound mail through the gateway)
`ip4:x.x.x.x`	Explicitly allow a specific IP address
`~all`	Softfail — accept mail from other sources but flag it (recommended to start with)
`-all`	Hardfail — reject mail from other sources (tighten after testing)

DKIM

DKIM (DomainKeys Identified Mail) is a cryptographic signature on outbound mail. The signature is generated by your mail server and verified by the recipient using a public key published in DNS.

DKIM is configured on your mail server (Exchange, Postfix, etc.) or cloud provider.

DKIM via MXGuard

If you use MXGuard as an outbound gateway, it can sign messages with DKIM itself - no need to configure signing on your own server.

Open the domain settings in the control panel
Go to Domains, select the domain, and open the DKIM tab.

Set a selector and generate a key
Enter a selector name (for example spz) and click "Generate DKIM". The panel creates an RSA-2048 key pair and shows the ready-to-use TXT record for DNS.

Add the TXT record to DNS
Copy the value from the "DKIM DNS record" field and add a TXT record to your domain's DNS zone:

Record name

spz._domainkey.yourdomain.com

Value

v=DKIM1; k=rsa; p=MIIBIjANBgkq...

Verify publication
After DNS propagates (usually 5–60 minutes), click "Check DKIM in DNS" - the panel compares the DNS TXT record against the saved key and shows the result.

If you leave the "Selector" field empty, MXGuard automatically uses the selector spz. The selector name is part of the DNS record name: selector._domainkey.domain.

You can check for a DKIM signature in your mail by sending a test message to check-auth@verifier.port25.com.

DMARC

DMARC tells recipients what to do with mail that fails SPF/DKIM checks, and where to send failure reports.

Minimal TXT record at _dmarc.yourdomain.com

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none - collect reports only, with no blocking. After reviewing the reports, tighten the policy:

Parameter	Meaning
`p=none`	Don't block, just collect reports
`p=quarantine`	Send messages that fail the check to spam
`p=reject`	Reject messages that fail the check (maximum protection)
`rua=mailto:...`	Email address for daily aggregate reports (XML)
`pct=10`	Apply the policy to only 10% of messages (for gradual rollout)

Recommended rollout order: p=none (1-2 weeks, review reports) → p=quarantine; pct=10 → p=quarantine → p=reject.