- Problem
- Website and tech
- Industry
- Photographer
- Year
- 2026
- Project type
- Own project
Mail setup: SPF, DKIM and DMARC for my own domain
SPF, DKIM and DMARC: 3 of 3 mechanisms are set and can be checked from the outside.
The number: 3 of 3
Mail mechanisms set: SPF, DKIM, DMARC
Starting point
My contact form sends mail through my own domain. Without sender checks, mail providers treat such messages with suspicion, and strangers can forge mail in my name. You only notice when replies land in spam, and then nothing tells you why. I wanted to set the three standard mechanisms properly before anything went wrong, and then check from the outside that they are really there.
What was built
I set three kinds of DNS records. SPF states who may send for the domain. DKIM signs outgoing mail with a key, 1024 bits long in my case. DMARC tells receivers how to handle failures and sends me reports. The form sends through a mail provider, Resend, using its own sending subdomain, which has its own SPF and its own MX record. Incoming mail still runs through my hosting provider.
Result
All three mechanisms are set. On 18 October 2026 I queried them through a public DNS service and through the local resolver, and both returned the same values. The DMARC policy is p=none, which means observation with reports and no protection against abuse. The lookup comes with this case as a file. That a specific mail arrives at Gmail with DMARC pass I have not proven so far, because only the header of a real test mail shows that.
Proof
You find the DNS lookup with every record verbatim. The report address is masked, the DKIM key is shortened, and hostnames of service providers do not appear in the visible text. As soon as I have a header screenshot of a form test mail, I will add it here. Until then this case says nothing about DMARC pass. The records are public, so you can check them yourself with any DNS lookup tool.
Limits
p=none does not stop forged mail, it only observes. Moving to quarantine only makes sense once the reports show that every legitimate sender sends in alignment. I have not measured delivery rates or spam rates, so I do not claim that nothing lands in spam any more. This case shows that the setup is in place and can be checked from the outside, not how many mails arrive. Sending runs through an external provider, not through a mail server of my own.