SPF, DKIM and PTR: what each record checks
SPF lets a domain publish which hosts may use its name in email. RFC 7208, April 2014, says administrative domains can explicitly authorize the hosts allowed to use their domain names, and a receiving host can check that authorization. Mail can otherwise be forged because ordinary SMTP does not restrict the domain in MAIL FROM or HELO.
Gmail's sender guidelines say the SPF record should include every sender for the domain. If a third-party sender is missing, messages from that sender are more likely to be marked as spam.
What do DKIM and PTR check?
DKIM lets the owner of a signing domain claim responsibility for a message. RFC 6376, September 2011, says that claim is checked with a cryptographic signature and by querying the signer's domain for the public key. Gmail says a DKIM key for mail to personal Gmail accounts must be 1024 bits or longer, and recommends 2048 bits when the domain provider supports it.
PTR is the reverse DNS record from the sending IP address back to a hostname. The same Gmail page says sending domains or IPs need valid forward and reverse DNS records, also called PTR records. Gmail treats SPF, DKIM, and PTR as separate checks. For all senders it requires SPF or DKIM. For bulk senders it requires SPF, DKIM, and DMARC.
DMARC tells the receiver what to do when SPF or DKIM does not pass, and the authenticated domain has to match the From header. Fixing only SPF does not satisfy the bulk-sender list.
Does a passing SPF record guarantee the inbox?
No. Gmail says messages that are not authenticated with the methods on its sender page might be marked as spam or rejected. Passing one check is not a placement promise. This page is not, by itself, a configuration service.
The managed hosting page lists DKIM, SPF, and DMARC as part of setup. This guide does not add a separate authentication product or a price.
What if mail bounces or an address is listed?
A listing is not the same as failing SPF, DKIM, or PTR. Those records authorize senders and sign messages. A listing is a separate reputation check.
When a recipient marks a message as spam, the message may be reviewed. If it is judged to be spam, the sending IP address or email address may be listed, especially when more than one source reports it.
Two common signs of a listing:
- Messages from one contact do not arrive. That contact may be listed.
- Bounceback messages say mail was not delivered. The sending server or address may be listed.
Avoid forwarding every message from a server inbox into Gmail, because that can forward spam as well. Instead, pull mail into Gmail with the mailbox POP, IMAP, and SMTP settings, then mark junk as spam.
Passing SPF, DKIM, or PTR is still not an inbox promise.
Related reading
Key takeaways
- SPF lets a domain publish which hosts may use its name in email.
- DKIM signs a message, and PTR is the reverse DNS record from the sending IP back to a hostname.
- For bulk senders, Gmail requires SPF, DKIM, and DMARC, so fixing only SPF does not satisfy that list.
- Passing one check is not an inbox promise.
Next step: Book a Managed Services intro.