Reference
Complete specifications for the records email authentication depends on — every mechanism, tag and limit, with what each one costs.
Articles 3
DKIM keys, selectors and signatures
How DKIM signing and verification work, every tag in the key record and the signature header, key lengths, rotation, and the l= tag you should never use.
DMARC tags and policy
Every DMARC tag with its default, how alignment is actually evaluated, what the reports contain, and a rollout order that does not break your mail.
SPF mechanisms and modifiers
Every SPF mechanism and modifier, what it matches, and whether it costs one of your ten DNS lookups — plus the limits that break real records.