SPF, DKIM and DMARC explained in plain English
What SPF, DKIM and DMARC each do, the DNS records to add for a sending domain, the order to set them up in, and the mistakes that make them fail.
Sam 5 min read
Updated
On this page
SPF, DKIM and DMARC are three DNS records that let a receiving mail server check that an email really comes from your domain. SPF lists who may send for you, DKIM signs each message, and DMARC tells receivers what to do when the first two fail. Gmail and Yahoo require all three from bulk senders, so set up DKIM first, then SPF, then DMARC.
The short version. Add the DKIM records your sending provider gives you, add the provider to one SPF record, publish a DMARC record that starts with p=none, and tighten it once your real mail passes.
Why these three records matter
Email was designed without any proof of who sent a message. Anyone can put your domain in the From line. Authentication records close that gap: they give Gmail, Outlook, Yahoo and every other receiver a way to tell your real mail from a forgery.
Since February 2024, Google and Yahoo ask every sender for SPF or DKIM, and ask anyone sending more than about 5,000 messages a day to Gmail addresses for SPF, DKIM and a DMARC record. Mail that fails is rejected or lands in spam. The rules are published in both companies' sender guidelines, and they apply whether you send through Amazon SES, SendGrid, Mailgun or your own server.
SPF: who is allowed to send
SPF is a TXT record on your domain that lists the servers allowed to send mail for it. When you send through a provider, you add that provider to the list:
v=spf1 include:amazonses.com ~allThree things about SPF catch people out:
- It checks the hidden return address (the MAIL FROM, also called the envelope sender), not the From address your reader sees. A custom MAIL FROM subdomain such as
mail.yourdomain.commakes the SPF check line up with your own domain. - A domain may have only one SPF record. Two records is an error, and receivers treat it as a failure. Merge them into one with several
include:parts. - It allows 10 DNS lookups at most. Each
include:costs at least one. Go over and the whole record fails.
DKIM: proof the message was not changed
DKIM adds a cryptographic signature to every message. The private key stays with your sending provider. The public key lives in your DNS, usually as one to three CNAME records the provider gives you. The receiving server uses it to confirm that the message was signed for your domain and was not altered on the way.
DKIM is the record that carries your reputation, and it survives forwarding, which SPF often does not. If you only have time to set up one thing properly, make it this one.
DMARC: what to do when the checks fail
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do with mail that fails, and where to send reports:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comA message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in your From address. That matching is called alignment, and it is why setting up DKIM on your own domain matters more than anything else.
| Policy | What receivers do with failing mail | When to use it |
|---|---|---|
p=none | Deliver as usual, send you reports | The first weeks, while you find every system that sends as you |
p=quarantine | Put it in spam | Once the reports show your real mail passing |
p=reject | Refuse it | When you are sure nothing legitimate still fails |
How to set them up, in order
- Add your domain at your sending provider and copy the DKIM records it gives you into your DNS.
- Set a custom MAIL FROM subdomain if your provider offers one, and add the MX and SPF records it asks for.
- Check you have exactly one SPF record on the domain you send from, and that it names every service that sends for you.
- Publish DMARC with
p=noneand an address for reports. - Wait, then verify. DNS changes are usually visible within an hour, occasionally longer.
- Read the reports for a few weeks, fix whatever fails, then move to
p=quarantineand laterp=reject.
In Glai, adding a sending domain shows the exact records to copy, checks each one against public DNS, and marks the domain verified once your provider can see them. If you send through Amazon SES, a new account also starts in a sandbox: here is how to get out of the SES sandbox.
Mistakes that make authentication fail
- Two SPF records. Usually one from your email host and one added later for a sending provider.
- Pasting the full name into a DNS panel that adds the domain itself, which creates
selector._domainkey.yourdomain.com.yourdomain.com. - A proxy switched on for the DKIM CNAME. On Cloudflare these records must be "DNS only".
- Jumping straight to
p=reject. A forgotten system (invoices, a helpdesk, a contact form) then has its mail refused. - Sending from a free mailbox address. You cannot authenticate a domain you do not control, so use an address on your own domain.
Authentication gets you through the door. Staying in the inbox depends on what happens next, so read how to keep your list clean as well.
Questions people ask
Do I need all three of SPF, DKIM and DMARC?
Yes, if you send in bulk. Gmail and Yahoo require SPF, DKIM and a DMARC record from senders of more than about 5,000 messages a day, and smaller senders are treated better with all three in place.
How long do the records take to work?
Most DNS changes are visible within an hour. Some DNS hosts take longer, and a record you have changed can be remembered by other servers for as long as its previous TTL.
Can I have more than one SPF record?
No. A domain must have a single SPF record. Combine every sending service into that one record with separate include parts.
What DMARC policy should I start with?
Start with p=none so that nothing is blocked while you read the reports. Move to p=quarantine and then p=reject once your legitimate mail passes.
Does passing authentication mean my email reaches the inbox?
No. It proves who sent the message. Inbox placement also depends on your complaint and bounce rates and on whether people open what you send.
Ready to set up a domain? Create a free Glai account, connect your sending provider and the records are shown for you to copy.