DKIM and DMARC: How to Configure Together
DKIM and DMARC work best when deployed jointly. DKIM provides cryptographic signatures that receivers can validate, and DMARC defines a policy that requires alignment between the visible From: domain and an authenticated identifier (DKIM d= or SPF). This guide outlines a pragmatic rollout plan.
Step 1: Enable DKIM
- Turn on DKIM at each sending platform (Microsoft 365, Amazon SES, SendGrid, etc.).
- Publish the provider’s DKIM DNS records (CNAME or TXT selectors) in Cloudflare.
- Send tests and confirm
dkim=pass in Authentication-Results.
Step 2: Publish DMARC (monitoring)
Start with a monitoring policy to discover all legitimate sources and see alignment status:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-aggregate@example.com; adkim=s; aspf=s"
Strict alignment (s) reduces spoof risk; relax if needed during migration (r).
Step 3: Fix Alignment
- DKIM alignment: Ensure signatures use
d=example.com (or an aligned organizational domain) matching the From: address.
- SPF alignment: Use a custom MAIL FROM domain or ensure return-path aligns with your domain; otherwise rely on DKIM.
Step 4: Enforce DMARC
- Move to
p=quarantine after validating sources and observing clean reports.
- Advance to
p=reject for strong protection once confident.
- Optionally set
sp= for subdomain policy and fine-tune pct= during staged rollout.
Validation and Operations
- Monitor aggregate reports to find misaligned senders and shadow IT deployments.
- Rotate DKIM keys periodically; deprecate old selectors after DNS propagation.
- Use ARC where forwarding intermediaries disrupt alignment.
Common Pitfalls
- Multiple independent platforms signing with different
d= domains that don’t align.
- Excessive SPF lookups causing permerror; consolidate includes.
- Ignoring reports; unmonitored changes can degrade deliverability.
With DKIM signatures in place and DMARC gradually enforced, your domain gains strong protection against spoofing while improving deliverability signals to major receivers.
