What are SPF, DKIM and DMARC?
They are three DNS records on your domain that prove your email is really from you. SPF lists the services allowed to send for your domain. DKIM adds a signature receivers can check. DMARC tells inboxes what to do when a message fails those checks, and can send you reports about who is using your domain.
Download the email deliverability checklist (PDF)6 pages, 384 KB, free to print. What's inside
The short version
- SPF: a list of the services allowed to send email for your domain.
- DKIM: a digital signature on each message, checked against a key published on your domain.
- DMARC: your instruction to inboxes about mail that fails: allow it, send it to spam, or reject it.
- All three are free DNS records. SPF and DMARC are TXT records; DKIM is a TXT or CNAME record, depending on your email provider.
How do the three records work together?
Your domain is your return address. Anyone can type it into the “From” line of an email, so receivers need a way to check.
SPF (Sender Policy Framework) is one TXT record listing who may send for you, such as Microsoft 365, Google Workspace, your newsletter tool and your invoicing app. Mail from a server not on the list fails SPF.
DKIM (DomainKeys Identified Mail) makes your email service sign each message. The receiver looks up the matching public key on your domain. Some providers give you that key to publish as a TXT record; others, such as Microsoft 365, give you CNAME records that point to it. Follow your provider’s setup page for the type. If the signature checks out, the message wasn’t changed on the way and really came through your service.
DMARC ties them together. It checks that the domain in the visible “From” line matches the domain that passed SPF or DKIM. Then it applies your policy: none (just report), quarantine (spam folder) or reject. It can also email you reports showing who is sending as your domain. The DMARC.org overview explains the standard.
See the glossary for SPF, DKIM and DMARC.
Why does it matter?
Without these records your invoices and replies are more likely to land in spam, and scammers can more easily send mail that looks like yours. Gmail’s sender guidelines require SPF or DKIM from every sender. Bulk senders, more than 5,000 messages a day to Gmail, need both plus DMARC. Yahoo’s requirements match.
What are the common mistakes?
- More than one SPF record. You need exactly one; add new senders to it instead.
- Forgetting a sender. The booking app or website form that sends “from” you must be in SPF or sign with DKIM.
- DKIM never switched on. Many providers need you to add the key and then turn signing on in their admin.
- Jumping straight to reject. Start DMARC at “none,” read the reports, then move to quarantine and reject once every real sender passes.
- Lost records after a move. Changing nameservers can leave DKIM keys behind. See how to change DNS safely.
What if mail still fails?
Send a test message and read its full headers (in Gmail, open the message and choose “Show original”). The headers record whether SPF, DKIM and DMARC passed, and a fail usually points to the sender that isn’t covered. If records look right but delivery is still poor, read why business emails go to spam.
How much does it cost, and how long does it take?
There is no charge for the records. Adding them takes minutes. Getting DMARC to a strict policy safely takes longer, because you read its reports until every service that sends for you is passing.
How does E-3 handle this?
Before changing any DNS we save a copy of the existing records. To see where your domain stands now, run our free email deliverability checker, or read our longer article on SPF, DKIM and DMARC for small businesses.
Related questions
Common questions
- Do I need all three?
- Gmail and Yahoo require every sender to have SPF or DKIM, and bulk senders to have SPF, DKIM and DMARC. Having all three is the safest setup for any business domain.
- Where do these records live?
- In your domain's DNS, wherever your nameservers point. That might be your registrar, your host or a DNS service like Cloudflare.
- Can a wrong record stop my email?
- It can stop mail being delivered or trusted. A second SPF record, or a strict DMARC policy before every sender is set up, are the usual culprits.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.