Sending domain and authentication

Required

• Publish an SPF record

  Required

  Publish one SPF record for every domain that sends mail, listing every server and service that sends for it.

• Sign every message with DKIM

  Required

  Sign every message with DKIM, using at least a 2048-bit RSA key on your own domain, and replace keys on a schedule.

• Enforce DMARC

  Required

  Publish a DMARC record, read its reports, and move from p=none to p=quarantine and then p=reject once all mail passes.

• Give sending servers matching DNS names

  Required

  Give every sending IP address a reverse DNS name that points back to the same address, and use that name in the SMTP greeting.

• Send and receive over TLS

  Required

  Offer STARTTLS with a valid certificate on every MX host, and send outgoing mail over TLS.

Optional

• Pin mail TLS with DANE

  Optional

  If your domain is signed with DNSSEC, publish TLSA records for your MX hosts, so sending servers check the certificate through DNS.

• Keep authentication through forwarders with ARC

  Optional

  If you run a mailing list or forwarding service, add ARC seals, so receivers can trust results that the forwarding broke.

• Show your logo with BIMI

  Optional

  Once DMARC is enforced, publish a BIMI record, so supporting inboxes show your verified logo next to your mail.