NAME
email-domain-auth — Email authentication for a small domain: test the mail path before changing DNS
SYNOPSIS
Tested how a domain’s mail is really delivered before choosing SPF, DKIM and DMARC settings, then published a strict SPF record and a DMARC record that reports.
SITUATION
My own business domain. Its website sends notifications through a mail relay, and nothing else sends mail as the domain.
WHAT I CHANGED
- Sent a test message through the relay and read the headers: the relay replaces the From address with its own account.
- That meant DKIM signing for the domain could not work through that relay, so I did not build it.
- Published an SPF record that lists the relay and ends in -all, so mail from any other server fails SPF.
- Published a DMARC record with p=none and aggregate reports sent to the business mailbox, so every server sending as the domain shows up in the reports.
HOW IT WAS CHECKED
| Measure | Before | After |
|---|---|---|
| SPF result for a server not listed | — | fail (-all) |
| DMARC policy published | — | p=none, with aggregate reports |
- The test message’s headers showed what the relay actually sends, before any DNS change.
- Looked up the published records: SPF ends in -all, and DMARC reads p=none with a report address.
STACK
- DNS
- SPF
- DMARC
- Postfix relay