Anyone can write any address in an email's "From" line (email spoofing). Three DNS-based standards let receiving servers check whether a message really comes from the domain it claims: SPF, DKIM and DMARC. Since 2024, Gmail and Yahoo require them from bulk senders, and missing records are a common reason for email landing in spam.
SPF: which servers may send
Sender Policy Framework is a TXT record that lists the servers allowed to send mail for your domain.
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"
include:adds another provider's servers.ip4:/ip6:add specific addresses.- The ending sets the policy:
-all(fail anything else),~all(softfail: accept but mark),?all(neutral).
The receiving server checks the IP of the connecting server against the record for the Return-Path domain.
Limits: only one SPF record per domain, at most 10 DNS lookups, and SPF breaks when mail is forwarded.
DKIM: a signature on every message
DomainKeys Identified Mail signs each message with a private key on the sending server. The public key is published in DNS:
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
The receiver uses the selector and domain from the DKIM-Signature header to fetch the key and verify that the signed headers and body were not changed. DKIM survives forwarding. Your email provider gives you the record to publish.
DMARC: the policy that ties it together
Domain-based Message Authentication, Reporting and Conformance tells receivers what to do when a message fails, and requires that SPF or DKIM passes for the same domain as the From address (alignment).
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"
| Policy | Effect |
|---|---|
p=none |
Monitor only, send reports |
p=quarantine |
Put failing mail in spam |
p=reject |
Refuse failing mail |
Start with p=none, read the reports for a few weeks to find every legitimate sender, then move to quarantine and reject.
Results you will see
| Result | Meaning |
|---|---|
| pass | The check succeeded |
| fail | The check failed; with DMARC reject the message is refused |
| softfail | SPF ~all: not authorized, but not rejected outright |
| neutral / none | No policy or no record |
| temperror / permerror | A DNS problem or a broken record |
Check a message's results with our Email Header Analyzer, and test your domain's records, including the 10-lookup limit, with the SPF, DKIM & DMARC Checker. It also generates correct records for you.
Setup checklist for your domain
- Publish one SPF record listing every service that sends for you.
- Turn on DKIM signing in each sending service and publish their keys.
- Publish a DMARC record with
p=noneand a reporting address. - If you run your own mail server, set a matching reverse DNS record.
- After a few weeks, tighten DMARC to
quarantine, thenreject.
Frequently asked questions
Do I need all three?
Yes. SPF and DKIM provide the checks; DMARC makes receivers act on them and protects your domain from spoofing.
Why does SPF fail on forwarded mail?
The forwarding server is not in your SPF record. DKIM usually still passes, so DMARC passes.
Can SPF, DKIM and DMARC stop all phishing?
They stop others from using your exact domain. They do not stop look-alike domains, so read the sender address carefully.