Set up and verify SPF, DKIM, and DMARC records

1-2 hr Impact: high ✓ Manual completion — a permanent stone

SPF, DKIM, and DMARC together form your domain's complete email authentication stack — verifying all three are correctly set up and working confirms your domain is protected against spoofing and that your legitimate email actually reaches inboxes instead of getting caught in spam filters.

This is foundational trust infrastructure for your entire domain, not just marketing email — a domain without proper email authentication is more vulnerable to impersonation and has real deliverability problems.

How to do it

1

Verify SPF is correctly configured

Lists every legitimate service authorized to send email as your domain.
2

Verify DKIM is signing correctly

Cryptographically proves outgoing email genuinely came from you.
3

Verify DMARC is at meaningful enforcement

Not just present, but actually set to quarantine or reject after a monitoring period, with reports being reviewed.
4

Test end to end

Send a real test email and check the authentication results in the received headers.

Common mistakes

This exact combination overlaps significantly with your Hardening Ring's email deliverability checks — this Legacy Ring mission may largely already be satisfied if those are passing.

How you will know it is done

SPF, DKIM, and DMARC are all correctly configured and verified working via a real test email.

Tools that help

MX Toolbox ↗

Validates all three records at once.

Set this stone in your hive

The Legacy Ring is permanent — once set, it stays set. This is the kind of work that outlasts any single scan or campaign.

Open this mission in H.I.V.E. →