# Email Authentication Standards
## SPF (Sender Policy Framework)
- `v=spf1 include:_spf.google.com -all` (hard fail recommended)
- Limit to 10 DNS lookups

## DKIM (DomainKeys Identified Mail)
- RSA-2048 minimum key length
- Rotate keys every 6-12 months

## DMARC (Domain-based Message Authentication)
- Start: `v=DMARC1; p=none; rua=mailto:dmarc@example.com`
- Goal: `v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100`
- Monitor → Quarantine → Reject progression
