Guide

SPF, DKIM and DMARC explained

How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.

Email was designed without any way to prove who sent a message. The From: address is just text, and anyone can type yours. Three DNS-based standards close that gap, and they only work properly together.

SPF: which servers may send

An SPF record is a TXT record at your domain listing the servers allowed to send mail for it: your mailbox provider, your newsletter tool, your helpdesk. A receiving server checks the connecting IP address against that list.

example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net -all"

SPF has a blind spot: it checks the envelope sender (the bounce address), not the From: address people see. A spoofer can pass SPF for their own domain while showing yours.

DKIM: a signature on every message

DKIM has your sending service sign each message with a private key. The matching public key is published in DNS under a selector, at <selector>._domainkey.example.com. A receiver fetches the key and verifies the signature, which proves the message came from someone holding the key and was not altered on the way.

DKIM survives forwarding, which SPF does not. But like SPF, on its own it says nothing about the visible From: address: a message can carry a valid signature from any domain.

DMARC: tying it to the From address

DMARC is what makes the other two useful against spoofing. It requires that SPF or DKIM not only pass, but pass for a domain that aligns with the From: address. It then tells receivers what to do when neither does, and where to send reports.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
  • p=none — monitor only. Failing mail is delivered as normal.
  • p=quarantine — failing mail goes to spam.
  • p=reject — failing mail is refused.

What you actually need

  1. An SPF record that lists every service that sends as you, and ends in ~all or -all.
  2. DKIM signing switched on at each of those services. Most have a setting that gives you the DNS records to add.
  3. A DMARC record, starting at p=none with rua= reporting, moved to p=reject once the reports show only legitimate mail.

Since 2024 Gmail and Yahoo require all three from anyone sending them bulk mail, so this is no longer optional for most organisations.

Check your DMARC record

More guides