SPF, DKIM, and DMARC Explained: The Complete Email Authentication Guide

If email is showing up in spam — or being rejected outright — the first thing to check is email authentication. SPF, DKIM, and DMARC are the three DNS-based records that prove to receiving mail servers that your email is legitimate. Gmail and Yahoo made all three mandatory for bulk senders in 2024. If you're missing any of them, deliverability will suffer.

This guide covers what each record does, why all three are necessary, and exactly how to set them up.

Why email authentication exists

Email's original design had no built-in sender verification. Any server on the internet could send a message claiming to be from any domain — which is why phishing and spoofing remain rampant. SPF, DKIM, and DMARC are layered standards developed over the last two decades to fill this gap.

SPF (Sender Policy Framework)

What it does: SPF is a DNS TXT record that lists the mail servers authorized to send email from your domain.

When a receiving server gets a message claiming to be from you@yourdomain.com, it looks up your SPF record and checks whether the sending server's IP address is on the authorized list. If it's not, the message fails SPF.

What an SPF record looks like:

v=spf1 include:sendgrid.net include:mailchimp.com -all

• v=spf1 — declares this as an SPF record
• include:sendgrid.net — authorizes SendGrid's servers
• -all — instructs servers to reject mail from any unlisted server (hardfail)

SPF alone is not enough: SPF only verifies the "envelope from" address (the technical sender), not the "From" address the recipient actually sees. DKIM and DMARC together close this gap.

Common mistakes:

• Using +all (no protection — any server is authorized)
• Forgetting to add your transactional email service (e.g. Resend, SendGrid, Postmark)
• Exceeding the 10 DNS lookup limit in a single SPF record

Verify your current SPF configuration with the free SPF & DKIM checker.

DKIM (DomainKeys Identified Mail)

What it does: DKIM adds a cryptographic signature to every outgoing email. The receiving server uses a public key published in your DNS to verify the signature.

This proves two things: (1) the message actually came from a server that has the private key, and (2) the message wasn't altered in transit.

How DKIM works:

1. Your mail server generates a signature from parts of the email (headers + body) using a private key
2. The signature is added as a DKIM-Signature header
3. The receiving server fetches your public key from DNS (at selector._domainkey.yourdomain.com)
4. The server uses the public key to verify the signature

DKIM is set up by your email provider, not you directly. Every major provider (Gmail, SendGrid, Postmark, Mailchimp) has documentation explaining how to generate the keys and add the DNS record. The setup involves adding a TXT record like this:

google._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

DKIM survives email forwarding better than SPF — because the signature is in the message itself, not tied to the sending IP.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

What it does: DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails both checks. It also enables reporting so you can see how your domain's email is being authenticated.

DMARC introduces the concept of alignment: the domain in the "From" header must align with the domain that passed SPF or DKIM. Without DMARC, a spammer could pass SPF using their own authorized domain while spoofing your brand in the visible "From" field.

A typical DMARC record:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com"

• p=reject — messages that fail DMARC should be rejected (strongest setting)
• p=quarantine — send failing messages to spam
• p=none — monitor only, don't affect delivery (use while setting up)
• rua= — email address to receive aggregate reports (XML summaries of who is sending as your domain)

The recommended rollout path:

1. Start with p=none and set up a report address
2. Review aggregate reports for 2–4 weeks to identify all legitimate sending sources
3. Confirm all sources pass SPF or DKIM alignment
4. Move to p=quarantine with pct=10 (apply to 10% of failing messages first)
5. Gradually increase pct to 100, then move to p=reject

Verify your DMARC setup with the free DMARC checker.

How SPF, DKIM, and DMARC work together

| Standard | What it checks | Vulnerability without the others | |---|---|---| | SPF | Is the sending IP authorized? | Passes for envelope domain, not visible From | | DKIM | Was the message signed by the domain? | No enforcement — just a signature | | DMARC | Do SPF/DKIM align with the visible From? | SPF and DKIM are incomplete without enforcement |

DMARC is the enforcement layer. It converts SPF and DKIM from passive verification tools into an active policy.

What Google and Yahoo require

Since February 2024, both platforms require all bulk senders (5,000+ emails per day) to have:

• SPF or DKIM configured (ideally both)
• DMARC with at least p=none
• A one-click unsubscribe link
• A spam complaint rate below 0.3%

Senders who don't meet these requirements see messages rejected or routed to spam.

Summary

Set up all three. SPF authorizes your sending servers, DKIM signs your messages, and DMARC enforces alignment and gives you visibility through reports. None of them replaces the others. And remember: authentication controls whether your email is trusted — it doesn't control whether your addresses are valid. Use email verification to handle list quality separately.