Migrate authentication records
Move SPF, DKIM, and DMARC to a new platform without dual-record failures.
- Difficulty:
- Intermediate
- Prerequisites:
- Inventory of current SPF includes and DKIM selectors
- Last updated:
- 2026-07-15
- Author:
- empire
Objective
Migrate sending infrastructure
Move sending to a new ESP or provider without breaking authentication.
Starting state
New signing/sending hosts known; old records still live
Prerequisites
- Inventory of current SPF includes and DKIM selectors
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- Old and new ESP
Inputs
- Current SPF
- New DKIM selectors
- DMARC policy
Step-by-step instructions
- InventoryList every include, IP, and selector still required for legitimate mail.
- Publish dual-compatible recordsAdd new DKIM selectors and SPF mechanisms before removing old ones.
- Verify then pruneConfirm alignment on the new path, then remove obsolete mechanisms carefully.
Verification
- Samples pass SPF/DKIM/DMARC on the new path
Common mistakes
- Multiple SPF TXT records
- Removing old include too early
- Lower DMARC to monitoring during the migration window?
Rollback / recovery
- Restore prior SPF/DKIM values from backup
Expected outcome
Authentication follows the new infrastructure without PermError.
When to escalate
- Widespread DMARC failures after prune
Related Learn Articles
Related Toolbox Tools
- digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
- MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
- Mail-TesterSend-a-message spam and authentication scoring for pre-send QA.
- Kitterman SPF validatorClassic web SPF policy evaluator used by operators for syntax checks.
- DKIMCoreDKIM key and signature oriented validation utilities.
- dmarcian inspectorsDMARC-focused inspectors and educational tooling from dmarcian.
- EasyDMARC free toolsFree DMARC/SPF/DKIM lookup and analysis utilities from EasyDMARC.
- PowerDMARC free analyzersFree authentication analyzers from PowerDMARC for SPF, DKIM, and DMARC.
- LearnDMARCInteractive DMARC learning and inspection helper for operators new to enforcement.
- URIports toolsDMARC and related reporting tools for operators collecting aggregate feedback.