How your mail proves it is from you: SPF, DKIM and DMARC
What the records do, why Rykon Mail signs with your own keys, and what to leave alone.
Updated 1 min read
Inboxes trust mail that can prove where it came from. Rykon Mail sets your domain up so every message it sends carries that proof, signed with keys for your own domain.
| Record | What it proves |
|---|---|
| SPF | Lists the servers allowed to send as your domain: your Rykon Mail mail server and Amazon SES, which sends campaigns and transactional mail. |
| DKIM | A signature on each message that only your domain's keys could make, so a receiving server can tell it was not altered. Mail from mailboxes is signed with a 2048-bit key; mail through Amazon SES with its own three keys. |
| Return path | A mail-from subdomain that collects bounces, so they are counted against the right address. |
| DMARC | Tells receiving servers what to do with mail that fails the checks, and where to send reports. |
DMARC
If your domain has no DMARC record, Rykon Mail asks for one with the policy p=none, which monitors without rejecting. If you already publish DMARC, yours is kept, whatever its policy.
Keep them in place
The records are listed on each domain's page under Your DNS records. Removing or changing the signing records later stops that domain sending, because Amazon SES stops trusting it.