SPF, DKIM & DMARC

SPF, DKIM and DMARC solve three different problems, and you need all three, not just one, for a receiving mail server to trust your domain.

When you connect a domain, Inkbox SAS publishes a default SPF record for you automatically: a softfail policy that flags unauthorized senders as suspicious without outright rejecting them. It's the safer default while your setup settles in.

Once you're confident every legitimate sending path goes through Inkbox SAS (no other services also sending as your domain), you can switch to advanced mode in your domain settings. That moves you to a hardfail policy: mail from unauthorized servers gets rejected outright instead of just flagged.

# Default (softfail)
v=spf1 mx ~all

# Advanced mode (hardfail)
v=spf1 mx -all

DKIM signing is handled automatically, so there's no key to generate or rotate yourself. When you add a domain, a signing key is created for it and every outgoing message is signed transparently before it leaves the server.

The public key is published under the standard selector (mail._domainkey.yourdomain.com by default), which is exactly what the DNS setup wizard shows you when you connect a domain.

DMARC ties SPF and DKIM together: it tells receiving servers what to do when a message fails either check, and gives you visibility via aggregate reports instead of leaving you guessing.

The DMARC assistant in your domain settings walks you through the same progression mail security teams recommend: start at p=none (monitor only, nothing gets rejected) so you can see what your real mail flow looks like in the reports. Once you're confident no legitimate mail is failing, move to p=quarantine, and finally p=reject once you're fully confident. Reports are sent to a mailto:dmarc@yourdomain.com address by default so you're not flying blind between each step.

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com

Perfect SPF, DKIM and DMARC won't save a brand-new domain that sends thousands of emails on day one. No sending history is one of the most common triggers for a spam filter or blacklist, independent of your DNS being correct.

That's why every newly-verified domain on Inkbox SAS ramps up automatically instead of sending at full volume immediately: 50 emails per 24h to start, then 150, then 300, then 500, spread progressively over the first 30 days. The ramp is always capped by your plan's daily sending limit, and if your bounce rate goes above 5% across 20 or more recent delivery events, the ramp freezes at its current tier until things improve, so a bad list can't blow through your domain's early reputation.

Putting it all together, here's the order that gives a new domain the best shot at consistent inbox placement: