SPF, DKIM, and DMARC Explained: The Complete Email Authentication Guide

If email is showing up in spam — or being rejected outright — the first thing to check is email authentication. SPF, DKIM, and DMARC are the three DNS-based records that prove to receiving mail servers that your email is legitimate. Gmail and Yahoo made all three mandatory for bulk senders in 2024. If you're missing any of them, deliverability will suffer.

This guide covers what each record does, why all three are necessary, and exactly how to set them up.

Why email authentication exists

Email's original design had no built-in sender verification. Any server on the internet could send a message claiming to be from any domain — which is why phishing and spoofing remain rampant. SPF, DKIM, and DMARC are layered standards developed over the last two decades to fill this gap.

SPF (Sender Policy Framework)

What it does: SPF is a DNS TXT record that lists the mail servers authorized to send email from your domain.

When a receiving server gets a message claiming to be from you@yourdomain.com, it looks up your SPF record and checks whether the sending server's IP address is on the authorized list. If it's not, the message fails SPF.

What an SPF record looks like:

v=spf1 include:sendgrid.net include:mailchimp.com -all

• v=spf1 — declares this as an SPF record
• include:sendgrid.net — authorizes SendGrid's servers
• -all — instructs servers to reject mail from any unlisted server (hardfail)

SPF alone is not enough: SPF only verifies the "envelope from" address (the technical sender), not the "From" address the recipient actually sees. DKIM and DMARC together close this gap.

Common mistakes:

• Using +all (no protection — any server is authorized)
• Forgetting to add your transactional email service (e.g. Resend, SendGrid, Postmark)
• Exceeding the 10 DNS lookup limit in a single SPF record

Verify your current SPF configuration with the free SPF & DKIM checker.

DKIM (DomainKeys Identified Mail)

What it does: DKIM adds a cryptographic signature to every outgoing email. The receiving server uses a public key published in your DNS to verify the signature.

This proves two things: (1) the message actually came from a server that has the private key, and (2) the message wasn't altered in transit.

How DKIM works:

1. Your mail server generates a signature from parts of the email (headers + body) using a private key
2. The signature is added as a DKIM-Signature header
3. The receiving server fetches your public key from DNS (at selector._domainkey.yourdomain.com)
4. The server uses the public key to verify the signature

DKIM is set up by your email provider, not you directly. Every major provider (Gmail, SendGrid, Postmark, Mailchimp) has documentation explaining how to generate the keys and add the DNS record. The setup involves adding a TXT record like this:

google._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

DKIM survives email forwarding better than SPF — because the signature is in the message itself, not tied to the sending IP.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

What it does: DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails both checks. It also enables reporting so you can see how your domain's email is being authenticated.

DMARC introduces the concept of alignment: the domain in the "From" header must align with the domain that passed SPF or DKIM. Without DMARC, a spammer could pass SPF using their own authorized domain while spoofing your brand in the visible "From" field.

A typical DMARC record:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com"

• p=reject — messages that fail DMARC should be rejected (strongest setting)
• p=quarantine — send failing messages to spam
• p=none — monitor only, don't affect delivery (use while setting up)
• rua= — email address to receive aggregate reports (XML summaries of who is sending as your domain)

The recommended rollout path:

1. Start with p=none and set up a report address
2. Review aggregate reports for 2–4 weeks to identify all legitimate sending sources
3. Confirm all sources pass SPF or DKIM alignment
4. Move to p=quarantine with pct=10 (apply to 10% of failing messages first)
5. Gradually increase pct to 100, then move to p=reject

Verify your DMARC setup with the free DMARC checker.

How SPF, DKIM, and DMARC work together

| Standard | What it checks | Vulnerability without the others | |---|---|---| | SPF | Is the sending IP authorized? | Passes for envelope domain, not visible From | | DKIM | Was the message signed by the domain? | No enforcement — just a signature | | DMARC | Do SPF/DKIM align with the visible From? | SPF and DKIM are incomplete without enforcement |

DMARC is the enforcement layer. It converts SPF and DKIM from passive verification tools into an active policy.

What Google and Yahoo require

Since February 2024, both platforms require all bulk senders (5,000+ emails per day) to have:

• SPF or DKIM configured (ideally both)
• DMARC with at least p=none
• A one-click unsubscribe link
• A spam complaint rate below 0.3%

Senders who don't meet these requirements see messages rejected or routed to spam.

Summary

Set up all three. SPF authorizes your sending servers, DKIM signs your messages, and DMARC enforces alignment and gives you visibility through reports. None of them replaces the others. And remember: authentication controls whether your email is trusted — it doesn't control whether your addresses are valid. Use email verification to handle list quality separately.

Use the free SPF & DKIM checker and DMARC checker to verify your authentication records are correctly configured.

Frequently Asked Questions

Do I need SPF, DKIM, and DMARC, or just one?

You need all three. SPF alone can be bypassed — an attacker can pass SPF using their own authorized server while spoofing your visible "From" address. DKIM provides cryptographic proof but no enforcement. DMARC is the enforcement layer that ties both together and applies a policy. Google and Yahoo have required all three for bulk senders since February 2024.

What is the difference between SPF and DKIM?

SPF verifies the sending server's IP address — it checks whether the IP is on your domain's authorized sender list. DKIM adds a cryptographic signature to the message itself, proving the content hasn't been tampered with and was sent by someone with access to your private key. SPF is tied to the IP; DKIM is tied to the message. Both are needed.

What is the difference between SPF and DMARC?

SPF checks whether the sending IP is on your authorized list. DMARC checks whether the domain in the visible "From" header aligns with the domain that passed SPF or DKIM, and enforces a policy (reject, quarantine, or none) when authentication fails. SPF is a verification mechanism; DMARC is an enforcement policy that protects your visible sender identity.

What is the difference between DKIM and DMARC?

DKIM provides cryptographic proof that the message came from an authorized source and wasn't altered in transit. DMARC is a policy that checks whether DKIM (or SPF) alignment is satisfied for the visible "From" domain, and defines consequences for failure. DKIM verifies authenticity; DMARC enforces the alignment requirement.

Does DMARC require DKIM?

No — DMARC requires either SPF or DKIM to pass with alignment, not necessarily both. However, DKIM alignment is strongly preferred because it survives email forwarding (where the sending IP changes, causing SPF to fail). In practice, configure both SPF and DKIM so either can satisfy DMARC requirements.

How do I check if SPF, DKIM, and DMARC are configured correctly?

Use the free SPF & DKIM checker to look up and validate your SPF and DKIM DNS records. Use the DMARC checker to check your DMARC policy and current enforcement level (p=none, p=quarantine, or p=reject). Both tools perform live DNS lookups and report any configuration issues.

What does DMARC alignment mean?

DMARC alignment means the domain in the email's visible "From" header must match — or be a subdomain of — the domain that passed SPF or DKIM. This is the core protection against spoofing: a sender must control the domain shown in the "From" field to pass DMARC, not just any authorized sending domain.

What should I start with — p=none, p=quarantine, or p=reject?

Always start with p=none and set a reporting address (rua=). Collect aggregate reports for 2–4 weeks to identify every legitimate sending source. Once all sources pass SPF or DKIM alignment, move to p=quarantine, then gradually to p=reject. Moving straight to p=reject can silently block legitimate mail from sources you forgot to configure.

---

Related reading:

• Email Sender Reputation: What It Is and How to Protect It
• Email Deliverability: What It Is and How to Improve It
• MX Records Explained: What They Are and Why They Matter