{"id":22680,"date":"2026-08-28T16:02:23","date_gmt":"2026-08-28T14:02:23","guid":{"rendered":"https:\/\/www.curiaweb.ch\/?post_type=docs&p=22680"},"modified":"2026-08-28T16:02:24","modified_gmt":"2026-08-28T14:02:24","password":"","slug":"spf-dkim-dmarc-hosting","status":"publish","type":"docs","link":"https:\/\/www.curiaweb.ch\/en\/hilfe\/e-mail-spamexperts\/spf-dkim-dmarc-hosting\/","title":{"rendered":"SPF, DKIM, and DMARC with CURIAWEB Hosting"},"content":{"rendered":"

SPF, DKIM, and DMARC<\/strong> are among the most important methods for email authentication. They help receiving mail servers assess whether a message was actually sent via authorized systems and whether the sender domain used matches the message.<\/p>\n\n\n\n

With normal CURIAWEB hosting, the required DNS records for SPF, DKIM, and DMARC are generally set up automatically. If you send your emails exclusively via the regular CURIAWEB mail infrastructure and the DNS zone is managed by CURIAWEB, you normally do not need to create these records yourself.<\/p>\n\n\n\n

\n

Important:<\/strong> Do not change SPF, DKIM, or DMARC records on suspicion. A misconfiguration can cause legitimate emails to fail authentication, resulting in poorer deliverability or classification as spam.<\/p>\n<\/blockquote>\n\n\n\n

What do SPF, DKIM, and DMARC do?<\/h2>\n\n\n\n

The three methods fulfill different tasks and complement each other.<\/p>\n\n\n\n

Procedure<\/th>Task<\/th><\/tr><\/thead>
SPF<\/strong><\/td>Defines which servers or IP addresses are allowed to send emails for a domain.<\/td><\/tr>
DKIM<\/strong><\/td>Signs outgoing messages with a cryptographic signature that can be verified via a public key in the DNS.<\/td><\/tr>
DMARC<\/strong><\/td>Link SPF and DKIM to the visible sender domain and publish a policy for DMARC checking.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Put simply, the interaction can be represented as follows:<\/p>\n\n\n\n

Outbound email\n       \u2193\nSPF\nIs the transmission path authorized?\n       +\nDKIM\nIs the cryptographic signature valid?\n       \u2193\nDMARC\nDoes at least one successful\nauthentication match the visible sender domain?\n       \u2193\nApply DMARC policy<\/code><\/pre>\n\n\n\n
SPF with standard CURIAWEB hosting<\/h2>\n\n\n\n
SPF<\/strong> stands for Sender Policy Framework<\/strong>. The SPF record is published as a TXT entry in a domain's DNS.<\/p>\n\n\n\n
With standard CURIAWEB hosting, the SPF record is automatically created in the DNS zone.<\/p>\n\n\n\n
For example, a typical standard CURIAWEB configuration looks like this:<\/p>\n\n\n\n
v=spf1 +a +mx +ip4:144.76.63.89 ~all<\/code><\/p>\n\n\n\n
The individual components have different functions:<\/p>\n\n\n\n
Component<\/th>Meaning<\/th><\/tr><\/thead>
v=spf1<\/code><\/td>Mark the TXT record as SPF version 1.<\/td><\/tr>
+a<\/code><\/td>Authorize the systems determined via the A-mechanism.<\/td><\/tr>
+mx<\/code><\/td>Authorize the systems resolved via the domain's MX records.<\/td><\/tr>
+ip4:144.76.63.89<\/code><\/td>Authorize this IPv4 address for sending.<\/td><\/tr>
~all<\/code><\/td>Other previously unrecorded shipping sources will receive an SPF softfail.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n
Important:<\/strong> The SPF record shown here is an example of the standard CURIAWEB hosting configuration. Do not copy it to another domain or hosting environment without first checking the actual transmission path.<\/p>\n<\/blockquote>\n\n\n\n
What does mean ~all<\/code>?<\/h2>\n\n\n\n
The ~<\/code> before all<\/code> referred to in SPF as a Softfail<\/strong>.<\/p>\n\n\n\n
Thus, the domain declares that systems not covered by the preceding mechanisms are not intended as regular dispatch sources. However, the ultimate handling of such a message rests with the receiving system and its further checks.<\/p>\n\n\n\n
This differs, for example, from:<\/p>\n\n\n\n
-all<\/code><\/p>\n\n\n\n
The minus sign designates an SPF Fail<\/strong>.<\/p>\n\n\n\n
Therefore, you should not simply change an existing SPF record from ~all<\/code> on -all<\/code> modify. A stricter policy only makes sense if the entire shipping environment is known and correctly taken into account.<\/p>\n\n\n\n
DKIM with CURIAWEB Hosting<\/h2>\n\n\n\n
DKIM<\/strong> stands for DomainKeys Identified Mail<\/strong>.<\/p>\n\n\n\n
While SPF authorizes the sending path, DKIM works with a cryptographic signature.<\/p>\n\n\n\n
Simply put, DKIM consists of two parts:<\/p>\n\n\n\n
Private DKIM key\n\u2192 is located on the sending system\n\u2192 signs the outgoing email\n\nPublic DKIM key\n\u2192 is published in the DNS\n\u2192 enables the recipient to verify it<\/code><\/pre>\n\n\n\n
The private key must not be publicly accessible. Only the public part is located in the DNS.<\/p>\n\n\n\n
What does a DKIM record look like?<\/h2>\n\n\n\n
DKIM uses a so-called Selector<\/strong>. This allows a domain to use different DKIM keys and rotate keys later.<\/p>\n\n\n\n
A DKIM DNS name generally follows this pattern:<\/p>\n\n\n\n
selector._domainkey.example.ch<\/code><\/p>\n\n\n\n
The corresponding TXT record contains, among other things, the public key.<\/p>\n\n\n\n
Schematically, a DKIM record looks like this, for example:<\/p>\n\n\n\n
v=DKIM1; k=rsa; p=PUBLIC_KEY<\/code><\/p>\n\n\n\n
The actual public key is significantly longer and is automatically generated for the domain in question.<\/p>\n\n\n\n
\n
Attention:<\/strong> Never use a DKIM key from another domain and do not copy DKIM records between domains. The respective key pair belongs to the specific DKIM configuration of the domain.<\/p>\n<\/blockquote>\n\n\n\n
You usually don't have to create DKIM yourself<\/h2>\n\n\n\n
In a standard CURIAWEB hosting configuration, DKIM is set up automatically.<\/p>\n\n\n\n
If your domain uses the CURIAWEB DNS zone and emails are sent via the designated mail infrastructure, you should therefore not create an additional DKIM record of your own.<\/p>\n\n\n\n
Multiple DKIM selectors are technically quite possible. However, they should only be present if the respective sending systems actually sign with these selector keys.<\/p>\n\n\n\n
What does DKIM check?<\/h2>\n\n\n\n
During sending, the message is signed with the private DKIM key. The receiving mail server reads, among other things, the domain and selector used from the DKIM signature.<\/p>\n\n\n\n
Using this selector, he can retrieve the corresponding public key in the DNS and verify the signature.<\/p>\n\n\n\n
For example, a successful DKIM result can be:<\/p>\n\n\n\n
dkim=pass<\/code><\/p>\n\n\n\n
appear in the authentication results of a received message.<\/p>\n\n\n\n
What does a DKIM error mean?<\/h2>\n\n\n\n
A DKIM error can have various causes. For example, the public key may be missing, an incorrect selector may be used, or the message or relevant signed components may have been modified after signing in such a way that the signature can no longer be successfully validated.<\/p>\n\n\n\n
A DKIM error should therefore be investigated based on the specific message and its routing.<\/p>\n\n\n\n
DMARC at CURIAWEB Hosting<\/h2>\n\n\n\n
DMARC<\/strong> stands for Domain-based Message Authentication, Reporting and Conformance<\/strong>.<\/p>\n\n\n\n
DMARC builds upon SPF and DKIM, but adds a crucial point: the relationship to the domain that the recipient sees as the sender in the visible From:<\/strong>-field of the email sees.<\/p>\n\n\n\n
With normal CURIAWEB hosting, a DMARC record is also created automatically.<\/p>\n\n\n\n
The default CURIAWEB configuration is:<\/p>\n\n\n\n
v=DMARC1; p=none;<\/code><\/p>\n\n\n\n
What does mean v=DMARC1; p=none;<\/code>?<\/h2>\n\n\n\n
In this basic configuration, the record consists of two essential pieces of information.<\/p>\n\n\n\n
Component<\/th>Meaning<\/th><\/tr><\/thead>
v=DMARC1<\/code><\/td>Marks the entry as DMARC version 1.<\/td><\/tr>
p=none<\/code><\/td>Do not publish a DMARC policy to quarantine or reject failed messages based solely on the DMARC policy.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
p=none<\/code> does not mean that SPF or DKIM are disabled. Likewise, it does not mean that a receiving spam filter has to accept a suspicious message.<\/p>\n\n\n\n
Other security and spam checks of the receiving system remain unaffected by this.<\/p>\n\n\n\n
Where is the DMARC record located?<\/h2>\n\n\n\n
DMARC is published as a TXT record under the special hostname _dmarc<\/code> published.<\/p>\n\n\n\n
For a domain like:<\/p>\n\n\n\n
example.ch<\/code><\/p>\n\n\n\n
will the DMARC record accordingly under:<\/p>\n\n\n\n
_dmarc.example.ch<\/code><\/p>\n\n\n\n
retrieved.<\/p>\n\n\n\n
What are p=none<\/code>, p=quarantine<\/code> and p=reject<\/code>?<\/h2>\n\n\n\n
DMARC knows various domain policies.<\/p>\n\n\n\n
Policy<\/th>Fundamental importance<\/th><\/tr><\/thead>
p=none<\/code><\/td>No DMARC-based quarantine or reject policy.<\/td><\/tr>
p=quarantine<\/code><\/td>Messages that fail DMARC should be treated accordingly as suspicious by the receiving system, typically through quarantine or spam processing.<\/td><\/tr>
p=reject<\/code><\/td>Messages that fail DMARC should be rejected.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n
Important:<\/strong> Do not simply switch a domain from p=none<\/code> on p=quarantine<\/code> or p=reject<\/code> um. Zuerst muss sichergestellt sein, dass alle legitimen Versandsysteme korrekt \u00fcber SPF und\/oder DKIM authentifiziert werden und das notwendige DMARC-Alignment erreichen.<\/p>\n<\/blockquote>\n\n\n\n
What does DMARC alignment mean?<\/h2>\n\n\n\n
DMARC pr\u00fcft nicht lediglich, ob irgendwo in einer Nachricht SPF oder DKIM erfolgreich ist. Entscheidend ist auch die Beziehung zur sichtbaren Absenderdomain.<\/p>\n\n\n\n
Diese Beziehung wird als Alignment<\/strong> referred to as.<\/p>\n\n\n\n
Simplified:<\/p>\n\n\n\n
Sichtbarer Absender:\ninfo@example.ch\n\nSPF:\nPr\u00fcfung des relevanten Envelope-Sender-Versandwegs\n\nDKIM:\nPr\u00fcfung der DKIM-Signatur und Signaturdomain\n\nDMARC:\nPasst eine erfolgreiche Authentifizierung\nzur sichtbaren Absenderdomain?<\/code><\/pre>\n\n\n\n
Damit erschwert DMARC unter anderem, dass ein Angreifer zwar irgendeine eigene Domain korrekt authentifiziert, im sichtbaren Absender aber eine fremde Domain verwendet und diese Authentifizierung als Nachweis f\u00fcr die fremde Domain ausgibt.<\/p>\n\n\n\n
M\u00fcssen SPF und DKIM beide erfolgreich sein?<\/h2>\n\n\n\n
F\u00fcr einen erfolgreichen DMARC-Test m\u00fcssen nicht zwingend SPF and<\/strong> DKIM gleichzeitig erfolgreich und aligned sein.<\/p>\n\n\n\n
DMARC kann grunds\u00e4tzlich bestehen, wenn mindestens einer der beiden Authentifizierungswege erfolgreich ist und die erforderliche \u00dcbereinstimmung mit der sichtbaren Absenderdomain gegeben ist.<\/p>\n\n\n\n
\n
Briefly explained:<\/strong> SPF und DKIM sind zwei unterschiedliche Authentifizierungswege. DMARC verbindet deren Ergebnisse mit der sichtbaren Absenderdomain.<\/p>\n<\/blockquote>\n\n\n\n
Warum verwendet CURIAWEB standardm\u00e4\u00dfig p=none<\/code>?<\/h2>\n\n\n\n
Eine Domain kann neben dem normalen Hosting-Mailserver weitere Systeme zum Versand verwenden. Dazu k\u00f6nnen beispielsweise Newsletterdienste, Shops, CRM-Systeme, Buchhaltungssoftware, Ticketsysteme oder externe Cloud-Dienste geh\u00f6ren.<\/p>\n\n\n\n
Eine pauschal versch\u00e4rfte DMARC-Policy kann problematisch werden, wenn solche legitimen Versandquellen nicht korrekt in die Authentifizierungsstruktur eingebunden sind.<\/p>\n\n\n\n
Die standardm\u00e4\u00dfige Konfiguration mit:<\/p>\n\n\n\n
v=DMARC1; p=none;<\/code><\/p>\n\n\n\n
vermeidet deshalb eine pauschale Anweisung, DMARC-fehlgeschlagene Nachrichten allein aufgrund dieser Policy zu quarant\u00e4nisieren oder zur\u00fcckzuweisen.<\/p>\n\n\n\n
Wenn f\u00fcr eine Domain eine strengere DMARC-Strategie gew\u00fcnscht ist, sollte zuerst die gesamte Versandlandschaft analysiert werden.<\/p>\n\n\n\n
Wann muss die automatische Konfiguration angepasst werden?<\/h2>\n\n\n\n
Solange du ausschlie\u00dflich die normale CURIAWEB-Mailinfrastruktur verwendest, besteht normalerweise kein Grund, die automatisch eingerichteten Eintr\u00e4ge zu ver\u00e4ndern.<\/p>\n\n\n\n
Eine Pr\u00fcfung beziehungsweise Anpassung kann jedoch notwendig werden, sobald zus\u00e4tzliche Systeme E-Mails mit deiner Domain als Absender versenden.<\/p>\n\n\n\n
Typical examples are:<\/p>\n\n\n\n