DMARC, SPF, and DKIM: The Three Records That Decide Whether Your Emails Land or Get Blocked

Your domain can send email. So can an attacker who wants to impersonate your domain. The only thing standing between those two situations is three DNS records: SPF, DKIM, and DMARC. If even one is missing or misconfigured, your domain is easier to spoof and your legitimate emails are more likely to land in spam.

Here is what each one does, in plain terms.

SPF: The Authorized Sender List

SPF stands for Sender Policy Framework. It is a TXT record in your DNS that lists which mail servers are authorized to send email on behalf of your domain.

A typical SPF record looks like this:

v=spf1 include:_spf.google.com ~all

Breaking that down: v=spf1 identifies it as an SPF record. include:_spf.google.com says the servers listed in Google's SPF record are also authorized for my domain. ~all means that messages from unauthorized servers should be treated as a soft fail -- accepted but marked as suspicious.

Using -all (hard fail) instead of ~all is stricter: unauthorized servers get rejected outright. This is better for domains you want to lock down completely.

The problem SPF does not solve: it checks the envelope sender (the technical From address used during SMTP), not the From header visible in email clients. That is where DKIM comes in.

DKIM: The Cryptographic Signature

DKIM stands for DomainKeys Identified Mail. When your mail server sends a message, it adds a DKIM-Signature header containing a hash of selected message fields (typically the From header, Subject, and body), signed with your private key.

The public key lives in DNS as a TXT record at a specific subdomain, like mail._domainkey.example.com. Receiving mail servers retrieve this key, verify the signature, and confirm two things: the message came from a server holding your private key, and the signed fields have not been altered in transit.

DKIM survives forwarding in a way SPF does not, because the signature travels with the message itself, not the server that sends it.

DMARC: The Policy That Ties Both Together

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It is a policy record that tells receiving servers what to do when a message fails SPF, DKIM, or both.

A DMARC record looks like this:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100

p=quarantine means: if a message fails DMARC alignment, put it in the spam folder. The other options are p=none (do nothing, just report -- good for starting out) and p=reject (reject the message outright -- the most protective setting).

rua=mailto:... tells receiving servers where to send aggregate reports. These reports show you how many messages are passing and failing authentication, and from which sources. They are invaluable for spotting misconfiguration or active spoofing attempts.

DMARC also introduces the concept of alignment: the domain in the From header (what your users see) must align with the domain that passes SPF or DKIM. This is the gap the other two records leave open.

The Order to Set Them Up

1. Start with SPF. Add a TXT record listing your sending sources.
2. Enable DKIM on your email provider. They will give you a TXT record to add to DNS.
3. Add DMARC with p=none first and set up reporting. Watch the reports for a week or two to confirm your legitimate sending sources are all passing.
4. Move to p=quarantine, then eventually p=reject once you are confident.

Jumping straight to p=reject without testing first is the most common mistake. If a legitimate source like your CRM or support tool is not covered by SPF or DKIM, its emails will start bouncing.

How to Check Your Setup

The DMARC Checker tool on this site looks up all three records for any domain and tells you what is configured, what is missing, and what the current policy does. It also flags common mistakes like overly permissive SPF records that include too many include directives or use +all (which authorizes every server on the internet to send as your domain).

If you run a domain and you have not looked at these records lately, check them now. Missing or broken DMARC is one of the most common reasons legitimate emails go to spam and one of the easiest ways for attackers to spoof your identity.