Understanding SPF, DKIM, and DMARC — Self-Hosting Custom-Domain Email with Stalwart and Dokploy

These systems authenticate outgoing mail.

SPF

SPF answers:

Which servers are authorized to send mail for this envelope domain?

Example:

example.com TXT v=spf1 mx -all

This authorizes the server listed in the domain’s MX record.

SPF checks the envelope sender, which may be different from the visible From: address.

DKIM

DKIM adds a cryptographic signature to outgoing messages.

The mail server signs using a private key.

Recipients retrieve the public key from DNS:

selector._domainkey.example.com

The recipient can then verify:

The signing domain controlled the private key
Signed parts of the message were not altered
The DKIM signature is valid

DMARC

DMARC checks whether SPF or DKIM passes and aligns with the visible From domain.

Example visible sender:

From: user@example.com

DMARC asks whether the authenticated SPF or DKIM domain aligns with:

example.com

Initial policy:

v=DMARC1; p=none; rua=mailto:postmaster@example.com

Meaning:

v=DMARC1
Use DMARC version 1.

p=none
Collect information but do not request rejection or quarantine.

rua=mailto:postmaster@example.com
Send aggregate reports to this address.

Moving to enforcement

Start with:

p=none

After verifying every legitimate sender, move to:

p=quarantine

Later:

p=reject

Do not enable reject until all legitimate sending systems have been tested.

This includes:

Stalwart
Transactional-email services
Newsletter providers
Contact-form services
Help-desk platforms
Monitoring tools
Any application that sends as the domain

A forgotten sender can fail DMARC and have legitimate messages rejected.