Email security for a domain rests on a handful of DNS standards. Three of them, SPF, DKIM and DMARC, stop other people sending mail in your name and help your genuine mail reach the inbox. Three more, MTA-STS, TLS-RPT and BIMI, add encryption rules, reporting and a logo. This page explains what each one does and the order to set them up in.
Our main guide, Email Deliverability Deep-Dive: SPF, DKIM, DMARC, BIMI, gives the exact records for all six standards, a complete example and the common mistakes. For mailbox protection, phishing and payment fraud, read Email Security Best Practices.
Set up SPF, DKIM and DMARC first: every sending domain needs them, and Gmail, Yahoo and Microsoft require them from bulk senders. Start DMARC at p=none, read the reports, then move to quarantine or reject. MTA-STS and TLS-RPT protect mail coming to you, and BIMI can show your logo in some inboxes once DMARC is enforced. None of them replaces strong passwords and two-factor login on your mailboxes.
1. The six standards at a glance
| Standard | What it does | Record | Priority |
|---|---|---|---|
| SPF | Lists the servers allowed to send mail for your domain | One TXT record on the domain | Essential |
| DKIM | Signs each message so receivers can check it wasn't forged or changed | TXT record at a selector | Essential |
| DMARC | Tells receivers what to do when SPF and DKIM fail, and sends you reports | TXT record at _dmarc | Essential |
| MTA-STS | Asks other servers to deliver to you only over verified TLS | TXT record plus a policy file over HTTPS | Optional |
| TLS-RPT | Sends you reports of TLS failures on mail sent to you | TXT record at _smtp._tls | Optional, pairs with MTA-STS |
| BIMI | Shows your logo next to your mail in supporting inboxes | TXT record at default._bimi plus an SVG logo | Optional, needs enforced DMARC |
2. SPF, DKIM and DMARC: the essentials
- SPF. Publish one SPF record that includes every service that sends mail as you: your hosting server, Business Email, a newsletter tool. Two SPF records on one domain break both. See Understanding SPF.
- DKIM. Your mail host creates the key; you publish the public half in DNS. On Domain India cPanel hosting, DKIM is on by default for new accounts. On DirectAdmin the selector is
xand most domains already have a key; see checking DKIM in DirectAdmin. - DMARC. Start with a monitoring policy, then tighten it once the reports show all your genuine mail passing:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Setting up DMARC walks through reading the reports and moving to p=quarantine and p=reject.
3. MTA-STS and TLS-RPT: encryption for incoming mail
MTA-STS needs a TXT record and a policy file served over HTTPS from https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. TLS-RPT is one TXT record that tells senders where to report failures:
_mta-sts.yourdomain.com TXT "v=STSv1; id=20260924000000"
_smtp._tls.yourdomain.com TXT "v=TLSRPTv1; rua=mailto:[email protected]"version: STSv1
mode: testing
mx: mail.yourdomain.com
max_age: 604800In enforce mode, senders refuse to deliver if your mail server's certificate doesn't match the mx names in the policy. A wrong policy can stop your incoming mail. Use mode: testing, read the TLS reports for a few weeks, and switch to enforce only when they are clean. Change the id whenever you change the policy. If your mail is hosted with us and you're unsure which MX names and certificate apply, ask support before enforcing.
4. BIMI: your logo in the inbox
BIMI needs DMARC at p=quarantine or p=reject, a logo in the SVG Tiny PS format, and a TXT record at default._bimi. Gmail shows the logo only with a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC). BIMI doesn't improve deliverability by itself; it is a branding layer on top of good authentication. The full process is in Complete Guide to BIMI and VMC.
5. The order to set things up
- SPF.One record covering every service that sends as you.
- DKIM.Turn it on for each sending service and publish the keys.
- DMARC at p=none.Collect reports for two to four weeks.
- Tighten DMARC.Move to
quarantine, thenreject, once genuine mail passes. - TLS-RPT and MTA-STS in testing mode.Switch to enforce when reports are clean.
- BIMI.Only after DMARC is enforced, and only if a logo in the inbox is worth the certificate cost to you.
6. Email security with Domain India
Hosting email on cPanel, DirectAdmin and Webuzo gives you SSL/TLS connections and SPF and DKIM through your control panel. Business Email runs on a separate platform, signs every message with DKIM and provides SPF and DMARC records for your domain:
- Priced per mailbox - start with one
- Email at your own domain ([email protected])
- Add and remove mailboxes yourself
- Webmail with calendar, contacts and tasks
The price on the card is a live list price and excludes 18% GST. Support is by 24/7 live chat and support tickets, with a first response to tickets within 15 minutes; there is no phone support.
Which email security records does every domain need?
SPF, DKIM and DMARC. They let receivers check that mail really comes from you, and Gmail, Yahoo and Microsoft require them from bulk senders. MTA-STS, TLS-RPT and BIMI are optional extras.
Should I start DMARC with p=reject?
No. Start with p=none and a reporting address, check the reports until all your genuine mail passes, then move to quarantine and finally reject.
What does MTA-STS protect?
MTA-STS protects mail sent to your domain. It tells other mail servers to deliver only over verified TLS, which blocks downgrade attacks. Start it in testing mode, because an enforced policy with the wrong MX names can stop incoming mail.
Does BIMI improve email deliverability?
Not by itself. BIMI shows your logo in supporting inboxes once DMARC is at quarantine or reject. Gmail needs a Verified Mark Certificate or a Common Mark Certificate to show it.
Is DKIM enabled on Domain India hosting?
DKIM is on by default for new cPanel accounts. On DirectAdmin most domains already have a key with the selector x. Business Email signs every message with DKIM.
Ready to secure your domain's email? Follow the Email Deliverability Deep-Dive, look at Business Email, or open a support ticket if a record isn't working.
Business Email with DKIM signing, SPF and DMARC records, and webmail over HTTPS.
See Business Email