SPF: authorize sending infrastructure
SPF publishes a DNS policy describing hosts authorized for a domain used in the SMTP conversation. That domain is not necessarily the visible From address. The policy should reflect legitimate services using the relevant envelope domain rather than every product associated with the company.
DKIM: sign with a domain's key
DKIM adds a cryptographic signature. A receiver can use a public key in DNS to verify the signature for the signing domain. It covers specified content and headers. The signing domain can differ from the visible From domain, so a valid signature is not the complete DMARC picture.
DMARC: evaluate alignment
DMARC uses the visible From domain as a reference. It considers whether a passing SPF or DKIM result aligns with that domain, and provides policy and reporting mechanisms. SPF passing for one domain does not automatically satisfy alignment for a different visible From domain.
Inventory senders before tightening policy
The mailbox provider might be configured while a support platform, invoicing tool, campaign system, or form is not. Build a sender list and follow current provider instructions. Use representative test results and reports before deciding whether stricter enforcement is appropriate.
Use a staged review
Establish existing records, service ownership, and mail flows. Validate changes with test messages and authentication results, and retain a rollback plan. Follow the evidence about legitimate senders rather than assuming the strictest policy is immediately suitable for every domain.
Understand the limits
Authentication helps recipients assess authorized domain use. It does not guarantee inbox placement or prove the content is trustworthy. Reputation, message content, recipient filtering, and other factors also matter. A delivery investigation may need to look beyond the records themselves.
A useful starting point
Review SPF, DKIM, and DMARC as a coordinated setup across legitimate senders.