What each record actually does
SPF lists which mail servers are allowed to send email claiming to be from your domain — receiving servers check the sending IP against this list. DKIM attaches a cryptographic signature to outgoing mail, letting receivers verify the message wasn't altered and genuinely came from a server holding your private key. DMARC ties the two together: it tells receivers what to do when a message fails SPF or DKIM alignment (ignore it, quarantine it, or reject it outright), and gives you visibility through aggregate reports.
Rolling out DMARC safely
Jumping straight to p=reject is the most common way to accidentally block your own legitimate mail — a third-party sender you forgot about, or a slightly misaligned SPF record, and messages start disappearing. Start with p=none, set an rua address so you actually receive aggregate reports, watch those reports for a couple of weeks to confirm every legitimate sender is passing alignment, then move to quarantine and eventually reject.
Publishing the DKIM record
A 2048-bit RSA public key, base64-encoded, is longer than the 255-byte limit a single DNS TXT string segment allows — this tool gives you both the pre-split, quoted zone-file format some DNS providers expect, and a single continuous line for providers whose web UI splits it automatically. If your DNS host's TXT record field only gives you one text box, use the single-line version; if you're editing a raw zone file, use the quoted chunks.
Frequently asked questions
What's the difference between SPF, DKIM, and DMARC?
SPF lists allowed sending servers. DKIM cryptographically signs mail so it can be verified. DMARC tells receivers what to do on failure and where to send reports.
Do I need all three?
For meaningful anti-spoofing protection, yes — DMARC needs at least one of SPF or DKIM properly aligned to actually enforce anything.
Is it safe to start DMARC with p=reject right away?
Not recommended. Start with p=none to monitor, confirm all legitimate senders pass, then move to quarantine and eventually reject.