Can I use multiple email providers with my website's DKIM, DMARC and SPF?

Question

I'm a software developer, with limited Mail server setup experience, running a little side SAAS on the side where I send emails to my customers. My domain has SPF, DMARC and DKIM setup and I use SendGrid email API for emails.

I'd like to be able to now enable my application to send email through either the current email provider I have OR using Amazon Simple Mail service API SMTP.

This means I would need to add SPF, DMARC and DKIM for Amazon Simple Mail Service. I know where and how to add these records but what I am not sure about is if it is possible or a good idea to add these records for both my existing email provider and Amazon Simple Mail Service.

In other words, can I send email using two or more email service providers through a single domain that I control where I add the DMARC, SPF and DKIM configuration.

Thanks

Answer 1

You can use multiple service providers to send mail for your domain. But, you cannot limit which specific addresses can be used by these providers, i.e. each of these providers can send mails for every address in your domain. This is because the granularity of SPF, DKIM, DMARC is at the domain level, not the address level.

This means that if one of these providers is insecure, then all mails from your domain are insecure. And even major providers are sometimes insecure - see SpamChannel: Spoofing Emails From 2 Million+ Domains and Virtually Becoming Satan. So think twice before trusting some provider to send mail with your domain.

As for the setup:

• You cannot have specific SPF records for each provider. Instead you need to include all of these providers into a single SPF record.
• You cannot have specific DMARC policies for each provider. There is one policy which covers all.
• You better use different DKIM keys with different DKIM identifiers for each provider, so that they don't need to share the private key.