# HG changeset patch
# User Ash McKenzie <amckenzie@gitlab.com>
# Date 1741841306 -39600
#      Thu Mar 13 15:48:26 2025 +1100
# Node ID 55fcc6d4b82c33b71d403fd528d29375db4462ea
# Parent  04ae6ae6dbd2b4c131244aff00eda5591956943c
Add Best practices / SPF, DKIM and DMARC sections

diff --git a/doc/settings/smtp.md b/doc/settings/smtp.md
--- a/doc/settings/smtp.md
+++ b/doc/settings/smtp.md
@@ -1338,6 +1338,22 @@
 Notify.test_email('destination_email@address.com', 'Message Subject', 'Message Body').deliver_now
 ```
 
+## Configuring SPF, DKIM, and DMARC
+
+After you configure SMTP on your GitLab instance, you should configure as many of the following protocols as possible:
+
+- [Sender Policy Framework (SPF)](https://en.wikipedia.org/wiki/Sender_Policy_Framework).
+- [DomainKeys Identified Mail (DKIM)](https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail).
+- [Domain-based Message Authentication, Reporting and Conformance (DMARC)](https://en.wikipedia.org/wiki/DMARC).
+
+These protocols work together to verify email sender identity and prevent email spoofing.
+
+Your DNS provider determines which protocols you can configure and how to configure them. As an example, you can see
+you would [configure these protocols for Cloudflare](https://www.cloudflare.com/en-au/learning/email-security/dmarc-dkim-spf/)
+if Cloudflare was your DNS provider.
+
+For more information, see [Understanding SPF, DKIM, and DMARC: A Simple Guide](https://github.com/nicanorflavier/spf-dkim-dmarc-simplified).
+
 ## Troubleshooting
 
 ### Outgoing connections to port 25 is blocked on major cloud providers