SPF, DKIM, and DMARC explained
The three DNS records that keep your mail out of spam, and how to add them safely.
Updated · 7 min read
Anyone can put your address in the From line of an email. SPF, DKIM, and DMARC are how receiving servers tell the real messages from the forgeries. Large inbox providers expect all three from anyone sending regularly, so it's worth setting them up on day one.
SPF: who may send for your domain
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send mail for your domain. A receiving server looks up the record and checks whether the sending server is on the list.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:provider.example ~all |
DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message. The public key lives in DNS, usually as a CNAME or TXT record under a selector such as selector._domainkey. Receivers use it to confirm the message came from your domain and wasn't changed in transit.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM to the address people actually see in the From line, and tells receivers what to do with mail that fails: nothing, quarantine it, or reject it.
- Start with p=none. Mail is delivered as normal while you confirm everything passes.
- Move to p=quarantine once you're confident all of your legitimate mail is authenticated.
- Finish at p=reject to stop forged mail from being delivered at all.
Checking your records
Chebu's DNS page for each domain compares the records it finds with the ones it expects, and tells you when an existing SPF record needs merging rather than replacing. You can also open any message you've sent in another mail app and look for spf=pass, dkim=pass, and dmarc=pass in the headers.