1. Inventory every legitimate sender
List the mail platform, website forms, CRM, invoicing service, newsletters and any device that sends with your domain. SPF can authorise envelope senders; DKIM signs selected headers and the body; DMARC evaluates alignment with the visible From domain.
2. Publish one SPF policy
Use a single TXT record beginning with v=spf1. Combine authorised mechanisms into that record instead of publishing several SPF records. Keep the DNS-lookup limit in mind and remove providers that no longer send.
3. Enable DKIM for each sending platform
Each platform supplies a selector and public key. Publish that key under selector._domainkey.example.com, enable signing and verify a received message. A record existing at the wrong selector proves nothing.
4. Start DMARC with visibility
Publish a DMARC record under _dmarc.example.com. Start with a monitoring policy when the mail estate is not yet understood, review aggregate reports, then move to a stronger policy as aligned mail is confirmed. Current DMARC is defined by RFC 9989.
5. Test a real message
Inspect the received message's Authentication-Results header. You need to see which domain passed SPF, which DKIM signature passed and whether either result aligned with the visible From domain.
6. Treat forwarding separately
Forwarding can break SPF because the forwarding server is not normally authorised by the original domain. A surviving aligned DKIM signature can still allow DMARC to pass, provided the message was not modified in a way that invalidates the signature.