SPF, DKIM, and DMARC Explained Simply
SPF, DKIM, and DMARC explained in plain English: what each record does, how they work together to authenticate your email, how to set them up, and the common mistakes that break them.
Overview
SPF, DKIM, and DMARC are the three DNS records that prove your email is really from you. Mailbox providers use them to decide whether to trust a message, and since February 2024 Gmail and Yahoo effectively require them for bulk senders — without them, your mail is far more likely to land in spam or be rejected. They sound intimidating but each has one job, and together they answer a simple question: "is this sender allowed to send as this domain, and was the message tampered with?"
What each record does
SPF (Sender Policy Framework) is a DNS TXT record listing which servers are allowed to send email for your domain — the receiver checks that the sending server is on the list. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message; the receiver verifies it against a public key in your DNS, proving the email wasn't altered and genuinely came from your domain. DMARC ties the two together: it tells receivers what to do when SPF or DKIM fails (none/quarantine/reject) and where to send reports, and it requires "alignment" between the visible From domain and the authenticated one.
An analogy: SPF is the guest list (is this sender approved?), DKIM is the tamper-proof seal (was the letter opened?), and DMARC is the policy the bouncer follows when something doesn't match, plus the incident log.
- SPF — DNS list of servers allowed to send for your domain
- DKIM — cryptographic signature proving the message is intact and yours
- DMARC — policy (none/quarantine/reject) + alignment + reporting
- All three are DNS records on your sending domain
Setup, and the mistakes that break it
Setup order: publish SPF and DKIM (your sending provider gives you the exact records — useSend, SES, etc. all document them), confirm both pass, then add DMARC starting at `p=none` to monitor reports without affecting delivery, and tighten to `quarantine` then `reject` once you're confident everything legitimate aligns. Use a checker to verify each passes before relying on it.
Common mistakes: more than one SPF record (only one is allowed — merge them), exceeding SPF's 10-DNS-lookup limit, forgetting to authenticate a new sending tool you added, or jumping straight to `p=reject` and blocking your own mail. Authentication isn't one-and-done — re-check it whenever you add a sender.
- Publish SPF + DKIM from your provider's exact records
- Add DMARC at p=none, then quarantine, then reject
- Only one SPF record; stay under 10 DNS lookups
- Re-authenticate every new sending tool you add
Common Mistakes
- Skipping SPF, DKIM, and DMARC, or assuming they're a one-time setup.
- Sending real volume from a brand-new, un-warmed domain.
- Reusing a stale list without re-verifying, so bounces spike.
- Ignoring complaint rate until a single bad campaign sinks the domain.
Sources & Further Reading
Official docs for current setup details, pricing, and API behavior — verify specifics there, since they change.
Related guides
More on spf dkim dmarc explained and the surrounding deliverability workflow:
FAQ
What are SPF, DKIM, and DMARC?
Three DNS records that authenticate your email. SPF lists which servers may send for your domain, DKIM adds a cryptographic signature proving the message is intact and genuinely yours, and DMARC tells receivers what to do when those checks fail (and sends you reports). Together they prove your mail is really from you.
Do I really need all three?
Yes, for reliable delivery. Gmail and Yahoo effectively require SPF, DKIM, and DMARC for bulk senders as of 2024, and missing any of them increases spam placement and rejections. They're the baseline of modern deliverability, not optional extras.
How do I set up DMARC safely?
Publish SPF and DKIM first and confirm they pass, then add a DMARC record at p=none to collect reports without affecting delivery. Once you've confirmed all your legitimate mail aligns, tighten the policy to quarantine and then reject. Jumping straight to reject can block your own email.
Why is my SPF or DKIM failing?
Common causes: more than one SPF record (only one is allowed), exceeding SPF's 10-lookup limit, a new sending tool you forgot to authenticate, or a mistyped DNS record. Use an SPF/DKIM/DMARC checker to see exactly which check fails and why.