SPF, DKIM and DMARC explained

Why they matter

Without these records, anyone can put your domain in the From field (say accounts@yourcompany.com) and send a forged message; the receiving server has no way to check whether it really came from you. That exposes your customers to phishing and makes your genuine mail look suspicious. Google and Yahoo (since February 2024) and Microsoft for Outlook.com and Hotmail (since May 2025) require SPF, DKIM and DMARC from domains sending more than about 5,000 messages a day, and Gmail requires at least SPF or DKIM from everyone. Mail that fails these rules lands in spam or is rejected with errors such as 550 5.7.26.

What is SPF and how does it work?

SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record listing the servers allowed to send mail for your domain. When a server receives a message, it checks whether the connecting IP is on that list. Strictly speaking, SPF checks the envelope sender (Return-Path) domain, not the From header you see.

An example SPF record for a domain that sends from its own server and from Google Workspace:

yourdomain.com.  TXT  "v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all"

• v=spf1: the version tag; every SPF record starts with it.
• ip4:203.0.113.10: your own mail server's IP.
• include:_spf.google.com: also authorizes Google Workspace.
• ~all: mail from unlisted servers is a "soft fail" (suspicious); -all makes it a hard fail.

What is DKIM and how does it work?

DKIM (DomainKeys Identified Mail, RFC 6376) adds a digital signature, made with a private key, to every outgoing message. The receiving server verifies it using the public key you publish in DNS. If the signature checks out, the signed parts of the message were not modified in transit, and the signing domain vouches for it. Unlike SPF, DKIM survives ordinary forwarding.

You don't write a DKIM record by hand: your mail server or provider generates a key pair and gives you the public key to publish, under a selector:

selector1._domainkey.yourdomain.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq...(long key)"

On cPanel, the Email Deliverability tool generates it for you; in Google Workspace it is under Admin console → Apps → Google Workspace → Gmail → Authenticate email; in Microsoft 365 it is in the Microsoft Defender portal under Email authentication settings → DKIM.

What is DMARC and how does it work?

DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the authenticated domain matches (aligns with) the domain in the visible From address. The DMARC record tells receivers what to do with mail that fails, and asks them to send you aggregate reports showing who is sending mail using your domain.

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100"

• p=none: monitor only, take no action (a safe starting point).
• p=quarantine: failing mail goes to the recipient's spam folder.
• p=reject: failing mail is refused outright (the strictest setting and the end goal).
• rua=mailto:...: where aggregate reports are sent.

Why you need all three

SPF alone is not enough because it usually breaks when mail is forwarded, and it checks a domain the recipient never sees. DKIM alone is not enough because the receiver cannot tell whether an unsigned or failing message should be trusted. DMARC ties them to the visible From domain and gives the receiver a clear instruction. With all three in place, spoofing your domain becomes very difficult.

Common mistakes

• Publishing more than one SPF record. Two v=spf1 TXT records on the same name invalidate SPF entirely.
• Switching providers without updating DKIM. When you move to a new mail provider, the old DKIM key no longer matches; forgetting to publish the new one breaks signing.
• Relying on SPF/DKIM without DMARC. Without DMARC, a forged message that fails SPF and DKIM can still land in the inbox; the results are informational, not an instruction.
• Using -all while forgetting a legitimate sender. If you also send through Mailchimp, SendGrid or similar and haven't authorized it, -all gets those messages rejected.
• Marketing tools signing with their own domain. DKIM passes, but it doesn't align with your From domain, so DMARC fails. Enable custom domain authentication in the tool.

Setup by platform

The exact values depend on your mail provider. Step-by-step guides: Google Workspace, Microsoft 365, Zoho Mail, Yandex 360, cPanel hosting. After setup, verify with the SPF, DKIM, DMARC checker.

How this relates to Spambil

SPF, DKIM and DMARC protect your outgoing mail from being impersonated. Spambil scans mail coming in to your domain and quarantines spam, malware and phishing, including messages that fail other domains' DMARC checks. The two complement each other: one says "nobody may send forged mail in my name", the other says "forged or malicious mail sent to me never reaches my inbox".

Frequently asked questions

Related pages