SPF, DKIM and DMARC are three DNS records that help email providers spot fake messages using your domain. SPF lists the servers allowed to send your email. DKIM adds a digital signature proving a message is really yours. DMARC checks that one of them matches your From address and tells providers whether to deliver, quarantine or reject messages that fail.
If you've ever been told to "set up SPF, DKIM and DMARC," you've probably also noticed that most explanations assume you already know what they are. This guide doesn't. It covers what each one does, how they fit together, and the mistakes that trip up most small businesses.
All three live in your domain's DNS settings, the same place your website address is managed. Each one is a short line of text. Together, they let Gmail, Outlook and other providers tell the difference between real email from your business and a scammer using your name.
What is SPF?
SPF (Sender Policy Framework) is your domain's list of approved senders. It's one TXT record that names the services allowed to send email for you, like Google Workspace or your newsletter tool.
A typical SPF record for a business on Google Workspace looks like this:
v=spf1 include:_spf.google.com ~all
Read left to right, that says: "This is an SPF record. Google's mail servers are allowed to send for this domain. Treat mail from anywhere else with suspicion." On Microsoft 365, the equivalent is v=spf1 include:spf.protection.outlook.com -all.
When a message arrives, the receiving provider looks up your SPF record and checks whether the server that delivered it is on the list. SPF has two blind spots worth knowing:
- It checks a behind-the-scenes "envelope" address, not the From address people see in their inbox. A scammer can pass SPF on their own domain while showing your name in the From line.
- It often breaks when email is forwarded, because the forwarding server isn't on your list.
DMARC (below) closes the first gap, and DKIM helps with the second.
Look up your current SPF record with our free SPF checker. It also counts DNS lookups so you know if you're near the limit.
What is DKIM?
DKIM (DomainKeys Identified Mail) is a digital signature on every email you send. Your email provider signs each outgoing message with a private key it keeps secret. You publish the matching public key in your DNS, so any receiver can check the signature.
If the signature checks out, the receiver knows two things: the message was signed by your domain, and it wasn't changed along the way. Because the signature travels with the message, DKIM usually survives forwarding when SPF doesn't.
DKIM records live at a special name called a selector, such as google._domainkey for Google Workspace. You don't write the record yourself. You switch DKIM on inside your email provider (Google Admin console or Microsoft Defender portal), and it gives you the exact record to add.
To confirm DKIM is on, check your email provider's admin settings. Outside scanners can only guess at selector names, so your provider's console is the definitive answer.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the rulebook. It tells receivers what to do when a message claiming to be from your domain fails its checks, and it asks them to send you reports about what they see.
A starter DMARC record looks like this, published at the name _dmarc:
v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com
The p (policy) part has three settings:
p=noneis monitoring mode. Providers deliver mail as usual and send you reports.p=quarantineasks providers to send failing messages to spam.p=rejectasks providers to refuse failing messages outright.
The rua address is where daily summary reports go. They show every server that sent mail using your domain and whether it passed, which is how you find both forgotten legitimate senders and impersonators.
Our free DMARC checker shows whether you have a DMARC record and which policy it uses.
How do SPF, DKIM and DMARC work together?
DMARC passes a message only if SPF or DKIM passes and the domain it checked matches the domain in the From address people see. That matching is called alignment.
Think of it like a delivery to your office. SPF checks that the courier works for an approved company. DKIM checks that the package has your tamper-proof seal. DMARC checks that the name on the label is yours, and tells the front desk what to do if anything doesn't add up.
Without alignment, a scammer could send from their own domain with perfectly valid SPF, put billing@yourbusiness.com in the From line, and sail through. With DMARC, that message fails, because the domain that passed SPF isn't yours.
Only one of SPF or DKIM needs to pass and align for DMARC to pass. That's why having both is useful. If forwarding breaks SPF, DKIM can still carry the message through.
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it checks | Whether the sending server is on your approved list | Whether the message has a valid signature from your domain and wasn't altered | Whether SPF or DKIM passed and matches the visible From address |
| Where it lives | One TXT record at your root domain (@) | A TXT or CNAME record at a selector name like google._domainkey, provided by your email provider | One TXT record at _dmarc |
| What happens without it | Receivers can't tell which servers are allowed to send as you, and your real mail is more likely to land in spam | Receivers can't confirm your messages came from you, especially after forwarding | Fakes that use your From address aren't flagged or blocked, and you get no reports |
If you're starting from scratch, follow our step-by-step guide on how to stop email spoofing, which sets up all three in the right order.
Find out which records your domain has
Our free checkup looks at SPF (including the 10-lookup limit), DKIM on common selectors, DMARC and your website basics in one report.
- Free check
- No signup
- No changes to your website
What are the most common SPF, DKIM and DMARC mistakes?
Most problems we see come from a handful of small, fixable mistakes.
Two SPF records
When you add a new email tool, its setup guide often says "add this SPF record." If you already have one, you now have two, and the SPF standard says that makes SPF fail for every message. The fix is to merge them into one line: keep a single v=spf1 at the start, put every include: in the middle, and one ~all or -all at the end. Then delete the extra record.
Ending SPF with +all
The ending of an SPF record tells receivers how to treat servers that aren't on your list. ~all means "be suspicious" and -all means "reject." But +all means "allow anyone," which approves every server in the world to send as you. If you see +all, change it to ~all.
Going over 10 DNS lookups
SPF allows at most 10 DNS lookups when a receiver checks your record. Each include:, a, mx and redirect counts, and some includes contain more includes inside them. Go over 10 and SPF returns an error, which many providers treat as a failure. The usual fix is removing services you no longer use. Our SPF checker shows how many lookups you're using.
Leaving DMARC at p=none forever
Starting at p=none is the right move. Staying there isn't. At p=none, fakes are reported but still delivered. Once your reports show your real senders passing for a few weeks, move to p=quarantine, then to p=reject. Our fix guide for DMARC policies walks through it.
Forgetting third-party senders
Your email provider isn't the only thing sending as you. Newsletter tools like Mailchimp, invoicing apps like QuickBooks, your online store, your booking system and your website's contact form may all send mail that shows your address. Each one that does needs to be authorized, usually with an SPF include, DKIM records, or both. Look for "authenticate your domain" in each tool's help center.
If you tighten DMARC before these are set up, their emails can start landing in spam. DMARC reports are how you catch them first.
Make a list of every app that emails customers or staff on your behalf, and check each one's domain authentication settings.
What do Google and Yahoo require from senders?
Since February 2024, Gmail and Yahoo have required senders to authenticate their email. The rules are often summarized as "everyone needs DMARC now," which overstates them. Google's sender guidelines split the rules in two.
Everyone sending to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com) must:
- Set up SPF or DKIM for their sending domain
- Have valid forward and reverse DNS for sending servers
- Send over an encrypted (TLS) connection
- Keep reported spam rates below 0.3%
- Not pretend to be sending from gmail.com
Bulk senders, which Google defines as close to 5,000 or more messages a day to personal Gmail accounts, must also:
- Set up both SPF and DKIM
- Publish a DMARC record, where a policy of
p=noneis acceptable - Make sure the From domain aligns with the SPF or DKIM domain
- Offer one-click unsubscribe on marketing and promotional messages
Yahoo's requirements follow the same pattern: SPF or DKIM for everyone, and SPF, DKIM and a DMARC policy of at least p=none for bulk senders.
Two details are worth knowing. Google counts all mail from your main domain, including subdomains, toward the 5,000 figure, and once you're classed as a bulk sender, that status is permanent. Google also says it began ramping up enforcement in November 2025, so mail that doesn't meet the rules is more likely to be delayed or rejected.
If you send newsletters or marketing email, ask your email marketing tool whether your domain is fully authenticated and whether one-click unsubscribe is turned on.
What should you do next?
- Check your SPF record and lookup count with our free SPF checker.
- See your DMARC policy with the DMARC checker, and fix a missing one with our DMARC fix guide.
- Follow the full setup in how to stop email spoofing, or the Google Workspace security checklist if you use Google.
- Run a free checkup to see your email and website results together.
Common questions
Do I need all three: SPF, DKIM and DMARC?
Yes, if you want providers to act on fake emails using your domain. SPF and DKIM let receivers check whether a message really came from you, but only DMARC tells them what to do when it isn't. Gmail and Yahoo also require all three from bulk senders.
What's the difference between ~all and -all in SPF?
Both tell receivers that servers not on your list aren't authorized. The ~all ending (soft fail) asks them to treat that mail with suspicion, while -all (hard fail) says to reject it. Google recommends ~all for Google Workspace, and once DMARC is enforcing, either works well. Never use +all.
Can I have more than one SPF record?
No. A domain must have exactly one SPF record. If there are two, SPF fails for every message. Combine all your senders into a single line that starts with v=spf1.
Does DMARC at p=none protect me?
Not on its own. At p=none, providers report on messages that fail but still deliver them normally. It's the right place to start, but you need to move to quarantine or reject to stop fakes.
Am I a bulk sender under Google's rules?
Google defines a bulk sender as anyone who sends close to 5,000 or more messages to personal Gmail accounts in a single day, counting all mail from the same main domain. Most small businesses never reach that, but if you do even once, Google treats you as a bulk sender permanently.
Sources
- RFC 7208: Sender Policy Framework (SPF) (RFC Editor (IETF))
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (RFC Editor (IETF))
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (RFC Editor (IETF))
- Email sender guidelines (Google)
- Email sender guidelines FAQ (Google)
- Sender Best Practices (Yahoo Sender Hub)
- Set up SPF (Google Workspace Admin Help)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.