Combined, these three types of DNS records act as an official security system for your domain's reputation. In a nutshell, they ensure that emails from that domain are being sent from an authorized server, haven't been altered on the way to their destination, and if they were, how to handle them accordingly.
How the security trio works
- SPF (Sender Policy Framework): Tells email providers around the world exactly which servers are authorized to send messages on your behalf.
- DKIM (DomainKeys Identified Mail): Works by adding a tamper-proof digital seal to every email you send, proving it hasn't been altered on the way to the recipient.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): Instructs the receiving mail servers on what to do with email that fails the SPF or DKIM checks, such as marking them as spam or blocking them entirely.
What this means for your emails
Having all three protocols in place changes how spam affects you on both sides of the inbox:
- For emails you send (Outbound): Since scammers are blocked from impersonating your domain, your sender reputation stays clean. This helps prevent your legitimate emails from ending up in your recipients' spam folders.
- For emails you receive (Inbound): Domain security prevents people from fake-sending emails as you, but it won't stop random spammers from emailing to you. Incoming junk mail is filtered separately by our servers.
Setting up SPF, DKIM, and DMARC is essential to configuring your domain with Thundermail. Once in place, they shield your domain from impersonators and help build the foundation for reliable inbox delivery.