SPF, DKIM, and DMARC Explained

The short answer: SPF lists which servers may send mail for your domain. DKIM adds a cryptographic signature proving a message came from your domain and was not altered. DMARC ties the two to the address people actually see in the From line and tells receivers whether to deliver, quarantine or reject mail that fails. You need all three for protection against spoofing and for reliable inbox placement.

Paying for Google Workspace or Microsoft 365 secures your mailboxes. It does not stop someone else sending a message that claims to be from your domain. Email was designed without sender verification, so the From address can be set to anything. SPF, DKIM and DMARC are three DNS-based standards, added later, that let receiving servers check the claim.

This page is the overview. Each section links to a deeper guide, so you can read it start to finish or jump to the part you need.

The Problem They Solve

An email has two sender identities. The envelope sender (also called MAIL FROM or Return-Path) is used by servers when passing the message along and is rarely shown. The header From is what your recipient sees in their mail app. Nothing in basic email links the two, and neither is verified.

So without authentication:

• Anyone can send mail that displays your domain in the From line
• Receivers have no instruction from you about what to do with suspicious mail
• Phishing and invoice fraud using your name can reach your customers and suppliers (see what business email compromise is and the cost of email spoofing)
• Your own legitimate mail is more likely to be treated as suspect

The Three Standards at a Glance

How a Message Is Checked: The Flow

When a message arrives, the receiving server runs this sequence:

The result is written into the headers, for example:

Authentication-Results: mx.google.com;
  spf=pass smtp.mailfrom=yourdomain.com;
  dkim=pass header.d=yourdomain.com header.s=google;
  dmarc=pass (p=REJECT) header.from=yourdomain.com

You can paste headers like these into the email header analyzer, and the guide to reading email headers explains every field.

SPF: The Authorised Sender List

SPF is a TXT record listing the servers and services allowed to send mail for your domain:

v=spf1 include:_spf.google.com -all

This one authorises Google Workspace and says everything else should fail. When mail arrives, the receiver checks the connecting IP against the list for the envelope-sender domain.

Know these limits:

• One record per domain. Two SPF records cause an error.
• 10 DNS lookups maximum. Includes from several vendors can exceed it, and then SPF fails for everything. See SPF too many DNS lookups.
• The ending matters, but less once DMARC is enforcing. See SPF hard fail vs soft fail.
• It does not survive forwarding, because the forwarder's IP is not in your record.

Learn the syntax in the SPF record syntax guide or start with what an SPF record is. To add a marketing platform or CRM without breaking the record, see adding third-party senders to SPF. Build one with the SPF generator and test it with the SPF checker.

DKIM: The Tamper-Evident Signature

DKIM signs each outgoing message. Your mail platform holds a private key and adds a DKIM-Signature header covering the body and selected headers. The matching public key sits in DNS, at selector._domainkey.yourdomain.com:

google._domainkey.yourdomain.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

The receiver uses the key to confirm the signature is valid, which proves the message was signed by someone controlling that domain's DNS and that signed content was not changed in transit. Unlike SPF, DKIM generally survives forwarding, because the signature travels with the message.

Providers rarely turn it on for you. Google Workspace and Microsoft 365 both require you to enable signing for your own domain; the steps are in the Google Workspace DMARC guide and the Microsoft 365 authentication guide. If you see dkim=fail in headers, work through DKIM signature failed. Create records with the DKIM generator and verify them with the DKIM checker.

DMARC: The Policy and the Reporting

DMARC is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

It does three jobs:

1. Alignment. It requires that the domain validated by SPF or DKIM matches the From domain. Without this, a spoofer could pass SPF using their own domain while displaying yours. Relaxed alignment (the default) accepts subdomains of the same organisational domain; strict requires an exact match.
2. Policy. p=none monitors only, p=quarantine sends failures to spam, p=reject blocks them. (See none vs quarantine vs reject.)
3. Reporting. Receivers send you daily XML aggregate reports showing who sends mail as your domain and whether it passes. If the raw reports are hard to read, compare the best DMARC monitoring tools.

Start at p=none to learn who your senders are, fix failures, then move to enforcement. The DMARC generator builds the record and the DMARC checker validates it.

Why You Need All Three

Each standard has a gap the others fill:

• SPF alone checks only the envelope sender, not the visible From address, and fails on forwarded mail.
• DKIM alone proves a signature is valid but does not say what to do when it is missing or wrong, and a valid signature from a different domain proves nothing about yours.
• DMARC alone has nothing to evaluate. It consumes SPF and DKIM results.
• All three: SPF authorises senders, DKIM proves integrity, and DMARC enforces alignment and gives you visibility.

Note that DMARC needs only one aligned pass. In practice, set up DKIM for every sender, because it keeps working through forwarding and third-party platforms where SPF often does not align.

What about domains that never send mail?

Parked and legacy domains are spoofing targets too. Publish v=spf1 -all and a DMARC record with p=reject on them, and your real domain's subdomains are covered by the root DMARC policy unless you override it with the sp= tag. It takes five minutes and removes an easy impersonation route.

Common Mistakes

Rollout Order

1. Audit what exists with the free email audit or the email security score.
2. SPF: list every real sender, stay under 10 lookups.
3. DKIM: enable signing on your mail platform and every third-party sender.
4. DMARC at p=none with reporting. Review for two to four weeks.
5. Fix failing legitimate sources.
6. Enforce: quarantine, then reject.
7. Optional extras: MTA-STS for transport encryption and BIMI for logos (see BIMI requirements for the certificate side).

Large senders have an extra reason to hurry: Google and Yahoo require authentication from bulk senders, covered in the bulk sender requirements guide, and you can test against them with the bulk sender compliance tool. Authentication also underpins deliverability generally; if mail is already landing in junk, see why your emails go to spam and how to check an email blacklist.

Frequently Asked Questions

What is the difference between SPF, DKIM and DMARC?

SPF verifies the sending server, DKIM verifies a cryptographic signature on the message, and DMARC checks that either result matches the visible From domain and applies your policy. SPF and DKIM supply evidence; DMARC makes the decision and reports on it.

Do I need all three?

Yes, in practice. DMARC cannot work without SPF or DKIM, and SPF or DKIM alone give receivers no policy and no reporting. Large mailbox providers now expect all three from bulk senders.

Does Google Workspace or Microsoft 365 set these up automatically?

Only partly. Both provide the SPF include, but you publish the SPF record yourself, you must enable DKIM signing for your domain, and DMARC is entirely your own DNS record.

Will DMARC stop all spoofing?

It stops exact-domain spoofing of your domain when set to reject and honoured by the receiver. It does not stop look-alike domains or display-name tricks, which need other defences.

How do I check if my domain has all three?

Run the free email audit or check each record individually with the SPF, DKIM and DMARC checkers linked above. A DKIM check needs your selector, which you can read from a sent message's headers.

Next Step

Check your domain now with the free email audit. If you would rather have it set up and enforced for you, see the email security setup service.