SPF, DKIM and DMARC in ten minutes

The three DNS records every sender needs, what each one proves, and how to check yours with a free tool.

Inbox providers ask one question before they decide where your email lands: is this sender really who they say they are? SPF, DKIM and DMARC are the three DNS records that answer it. Without them, even a perfect email is a stranger at the door.

SPF: who may send for your domain

SPF is a TXT record on your domain that lists the servers allowed to send mail for it. A typical Google Workspace record looks like v=spf1 include:_spf.google.com ~all. When a message arrives, the receiving server checks whether it came from a server on that list.

• Keep one SPF record per domain. Two records break SPF entirely.
• SPF allows at most ten DNS lookups. Every include: counts, so remove services you no longer use.

DKIM: proof the message wasn't changed

DKIM adds a cryptographic signature to every email. Your provider holds the private key; the public key sits in DNS under a selector, for example google._domainkey.yourdomain.com. The receiver checks the signature against it. If anything in the signed parts of the message changed on the way, the check fails.

Your email provider generates the DKIM record for you. In Google Workspace it's under Apps, Gmail, Authenticate email; in Microsoft 365 it's in the Defender portal under DKIM.

DMARC: what to do when checks fail

DMARC ties the two together. It tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. Start with monitoring: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Once reports show your legitimate mail passing, move to p=quarantine, then p=reject.

Why it matters more since 2024

Since February 2024, Gmail and Yahoo require every sender to authenticate with SPF or DKIM. Bulk senders, defined by Google as those sending around 5,000 or more messages a day to Gmail addresses, must have SPF, DKIM and DMARC, keep spam complaints below 0.3%, and offer one-click unsubscribe in marketing mail.

Check yours now

Our free domain checker looks up your SPF, DKIM, DMARC, MX and tracking records live and explains in plain words what to change. It doesn't need an account. Blacklist checks are being added; until then the checker says so rather than guessing.

Try it

Warmup, verification and the team inbox are free. Start free; you only pay $1 per 1,000 emails that send.