Guide
SPF, DKIM, and DMARC, together.
These three records answer different questions. SPF lists which servers may send for the domain. DKIM signs the message. DMARC tells receivers what to do when those checks fail, and where to send reports.
Mailwright product team · Updated 2026-10-05
A sequence, not three slogans
Publish SPF for the server that actually sends. If you send through a mailbox provider, their documentation names the include. A record that forgets that server fails legitimate mail.
Sign with DKIM using a selector your provider gives you. The public key goes in DNS. The private key stays with the sender. Mailwright does not hold that key unless you are sending through an account you connected, in which case the provider signs, not this app.
Add DMARC after SPF and DKIM pass on a real message. Start with a policy of none and a report address if you want to watch before you quarantine. Moving straight to reject can block mail you forgot about, such as a billing tool or a support desk.
Where to do the work
The records live at your DNS host. The steps in the documentation are the checks to make. Mailwright does not edit the zone for you.