Authentication
SPF, DKIM, DMARC, transport security, and domain trust.
Sender Policy Framework (SPF)
Publish one bounded SPF policy that authorizes legitimate envelope senders without exceeding DNS lookup limits or permitting the world.
RequiredDomainKeys Identified Mail signatures
Sign outgoing mail with DKIM using aligned domains, protected private keys, rotating selectors, and canonicalization that survives normal transit.
RequiredDMARC alignment and policy
Publish DMARC, collect reports, align SPF or DKIM with the visible From domain, and move to enforcement only after legitimate flows pass.
RequiredSTARTTLS on MX hosts
Offer STARTTLS on every MX host with a certificate that matches its hostname and a current TLS configuration, so incoming mail can be encrypted.
RecommendedSMTP MTA Strict Transport Security (MTA-STS)
Publish an MTA-STS policy so sending servers require valid TLS to your MX hosts instead of silently falling back to plaintext.
RecommendedSMTP TLS Reporting (TLS-RPT)
Publish a TLS-RPT record so sending servers report failed TLS connections to your mail servers, and read the reports.
RecommendedDANE for SMTP
Publish DNSSEC-signed TLSA records for your MX hosts so sending servers can verify their certificates without trusting the CA system alone.