Understanding SPF, DKIM and DMARC for your email

SPF, DKIM and DMARC are three small DNS records that do one big job: they prove your email is really from you. Together they stop criminals from sending fake mail "from" your domain, and they help your genuine mail reach the inbox instead of the spam folder. This article explains each one in plain English, and how Skyline sets them up for you.

Why this matters

Without these records, anyone can send email that claims to be from your domain. That hurts your customers (phishing) and your reputation (your real mail starts landing in spam). For professional and Saudi business email, having all three is the expected standard.

SPF — who is allowed to send

SPF (Sender Policy Framework) lists which servers may send mail for your domain. With Skyline your record is simply:

v=spf1 include:_spf.alskyline.com -all

Notice it's a name, not a list of IP addresses — exactly like the big providers (Google uses include:_spf.google.com). The actual sending servers live behind that name, so:

• You never see or manage IP addresses.
• If Skyline's mail servers ever change, nothing in your DNS needs editing.

The -all at the end means "anything not listed is forged" — the strict setting.

DKIM — a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. The receiver checks that signature against a public key published in your DNS at skyline._domainkey.yourdomain. If a message was altered or forged, the signature fails. Skyline generates the key and signs your mail automatically — there's nothing for you to install.

DMARC — the enforcement policy

DMARC ties SPF and DKIM together and tells receivers what to do when a message fails both:

• p=none — monitor only (just collect reports).
• p=quarantine — send failing mail to the spam folder.
• p=reject — bounce failing mail outright (the strongest).

Skyline sets p=reject by default, with strict alignment — the strongest anti-spoofing posture. If you need a gentler rollout, the policy is configurable; just ask support.

One thing to watch with p=reject

p=reject means mail sent "as" your domain from any source other than Skyline will be rejected. If you use a third-party tool — a marketing platform, a CRM, an app — that sends email using your domain, either route it through Skyline or tell support so we can soften the policy or align the other sender. Mail sent through Skyline is always aligned, so your normal mail is never affected.

How to check yours

In the Skyline Cloud portal, open your domain's Email authentication page. It shows the live status of SPF, DKIM and DMARC and flags anything that needs attention. The one-click Set up email action publishes all three for you in the correct form.

In short

• SPF says who can send.
• DKIM proves the message wasn't forged.
• DMARC enforces both and stops spoofers.

Skyline configures all three to the recognised standard automatically — you just turn email on.