SPF, DKIM and DMARC are the three DNS records that prove your email is genuinely from your domain. SPF lists who can send for you, DKIM signs each message cryptographically, and DMARC tells receivers what to do when either fails and sends you reports.
SPF: who is allowed to send
SPF is a TXT record on your domain that lists the servers and services authorised to send mail using your domain in the envelope sender. When a receiving server gets a message, it looks up your SPF record and checks that the sending IP is on the list. Fail, and the message is suspect.
SPF breaks if you go beyond 10 DNS lookups in the record, so consolidate includes carefully when you use multiple sending services.
DKIM: proof the message was not altered
DKIM adds a cryptographic signature to every outgoing message, signed with a private key on the sending side. Receivers fetch the matching public key from a DNS record and verify the signature. A valid signature proves the message came from your domain and was not modified in transit.
DMARC: the policy that ties it together
DMARC is a DNS policy that does two jobs. It tells receivers what to do with mail that fails SPF or DKIM authentication: monitor (p=none), quarantine, or reject. And it sends you aggregate reports about who is sending mail claiming to be your domain, including spoofers.
The key concept is alignment: the domain DMARC checks (in the From header) must match the domain SPF or DKIM authenticated. Without alignment, spoofers can pass SPF on their own domain and still forge yours.
How they work together
SPF confirms the sending server is allowed. DKIM confirms the message body is intact. DMARC confirms both relate to the visible From domain and dictates the consequence when they do not. All three are required to be a trusted bulk sender today.
Setup basics
- Publish an SPF TXT record listing every service that sends on your behalf.
- Enable DKIM signing in every ESP and publish the corresponding public keys.
- Publish a DMARC record at _dmarc.yourdomain.com with p=none and a reporting address (rua=).
- Read the aggregate reports for two to four weeks. Fix any legitimate senders that are not aligning.
- Tighten DMARC to p=quarantine, then to p=reject once you are confident.
Common mistakes
- Two SPF records on the same domain. Only one is valid; merge them.
- Forgetting to publish DKIM keys for a new ESP, then wondering why mail fails alignment.
- Setting DMARC straight to p=reject without monitoring first, and blocking your own transactional mail.
- Publishing DMARC on the root but signing from a subdomain without sp= (subdomain policy).
Frequently asked questions
Do I need all three of SPF, DKIM and DMARC?
Yes if you send any meaningful volume. Gmail and Yahoo require all three for senders pushing more than 5,000 messages a day, and Microsoft is heading the same way.
Is p=none enough?
p=none lets you monitor but does not protect against spoofing. Once your aggregate reports are clean, move to quarantine and then reject.
Can DMARC reports tell me who is spoofing my domain?
Yes. Aggregate reports list every IP claiming to send as your domain. Forensic reports add per-message detail where receivers support them.