Why authentication matters
Anyone can claim to send from your domain. SPF, DKIM, and DMARC are the standards receiving servers use to tell genuine mail from spoofed mail. Get them right and your mail lands in the inbox; get them wrong and it lands in spam - or is rejected outright.
SPF - who's allowed to send
SPF (Sender Policy Framework) is a DNS record listing which servers may send mail for your domain. A receiving server checks whether the sending IP is on that list.
v=spf1 include:joltmx.io ~all
The include:joltmx.io authorises JoltMx. You can only have one SPF record per domain - if you already send through another provider, merge their include: into the same record rather than adding a second.
DKIM - a tamper-proof signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The receiving server fetches your public key from DNS and confirms the signature, proving the mail really came from your domain and wasn't altered in transit. JoltMx generates a unique DKIM key per domain when you add it - you publish the record once and JoltMx signs on every send.
DMARC - the policy that ties it together
DMARC tells receiving servers what to do when SPF or DKIM fails, and asks for reports. A typical record:
Type Host Value
TXT _dmarc v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.comThe policy (p=) escalates as your confidence grows:
| Policy | Effect |
|---|---|
p=none | Monitor only - collect reports, take no action. Start here. |
p=quarantine | Send failing mail to spam. |
p=reject | Refuse failing mail entirely. The strongest protection. |
Roll it out gradually. Begin atp=none, confirm your legitimate mail passes in the reports, then move toquarantineand eventuallyreject.
The forwarding problem - and SRS
Forwarding breaks plain SPF. When JoltMx forwards a message, the receiving server sees JoltMx's IP but the original sender's domain in the envelope - an SPF mismatch. The fix is SRS (Sender Rewriting Scheme): JoltMx rewrites the envelope sender so the bounce path aligns with SPF. JoltMx applies SRS automatically, so forwarded mail stays authenticated without any work from you.
How JoltMx checks inbound mail
Every message JoltMx receives is screened before it's routed:
- The sending IP is checked against Spamhaus blocklists and rejected if listed.
- SPF is evaluated, DKIM signatures verified, and DMARC alignment checked.
- If the sender's domain publishes
p=rejectand the message fails, it's rejected. - Results are recorded per message - open any message in the dashboard to see
SPF pass · DKIM pass · DMARC alignedat a glance.
Next step
Setting up records for the first time? Follow Add and verify your domain. Seeing mail go missing? Work through Mail isn't forwarding.