SMTP, SPF, DKIM & DMARC — Cheat sheet

Standard MTA-to-MTA port; often blocked outbound on consumer links.

Recommended submission port for authenticated clients/apps with STARTTLS

Commonly offered for implicit TLS submission.

Mailbox access, separate from SMTP sending.

250 generally means the SMTP step was accepted.

The sending MTA should normally retry later.

Check recipient address, domain and routing.

Often related to relay, anti-spam, SPF/DKIM/DMARC or permissions.

SPF is a TXT record; multiple separate SPF records make evaluation invalid.

Authorizes declared infrastructure and fails other sources.

include, a, mx, exists and redirect can consume the limit.

Confirm that a single v=spf1 record is published.

Allows multiple keys and rotation without changing the From domain.

DNS contains the public key; private key stays with the sender.

Use the selector shown in the DKIM-Signature header.

Keep overlap long enough for messages still in transit.

DMARC policy is published under _dmarc.

Often start with none for visibility before enforcement.

SPF pass alone is not enough if the domain is not aligned.

DMARC passes when at least one aligned mechanism passes.

Checks published receiving servers.

Checks policy and reporting addresses.

Validates TCP only, not authentication or message submission.

Inspects certificate and STARTTLS negotiation where OpenSSL is available.

Read bottom-up to reconstruct the delivery path.

Often the most useful evidence of authentication failure.

Used for SPF evaluation and bounces.

Keep it for correlation in message traces.

Confirm delivery reaches the right service before domain authentication.

Identify the actual sending source, especially apps and relays.

Check pass/fail and alignment with From.

Authenticated mail can still be blocked by content or reputation.