Guide
SPF, DKIM and DMARC explained in plain English
SPF, DKIM and DMARC are three DNS records that prove your email really comes from you, which helps it reach inboxes and makes it harder for someone to forge your address. SPF lists who may send for your domain, DKIM signs each message and DMARC says what to do when a message fails. Most small businesses should set up all three.
In one table
What each record does
| Record | Plain-English job | Where it lives |
|---|---|---|
| SPF | A list of the servers allowed to send mail for your domain | A TXT record on your domain |
| DKIM | A digital signature added to each message you send | A TXT record holding a public key |
| DMARC | A policy that says what to do with mail that fails, and where to send reports | A TXT record on _dmarc |
The problem
Why email needs authentication
Email was designed in a trusting age. Anyone can put any address in the "from" line of a message, which is why spam and phishing can pretend to come from a bank, a supplier or your own company.
Receiving servers need a way to check. SPF, DKIM and DMARC give them one. When your records are right, a receiving server can see that a message from your domain really came from an authorised source, and it will trust your mail more. When they are missing, your genuine messages are more likely to be treated as suspicious, and forged messages in your name are more likely to get through.
How a message is checked
What a receiving server does
- Message arrivesIt claims to be from your domain
- SPF checkWas it sent from an allowed server?
- DKIM checkIs the signature genuine and unchanged?
- DMARC policyBoth align? If not, follow your policy
- Deliver or rejectInbox, spam folder or refused
Each in turn
The three records explained
SPF
You publish a list of authorised senders. A typical record names your mail server and any service that sends for you, and ends with a rule for everything else.
DKIM
Your mail server signs each message with a private key. You publish the matching public key in DNS so receivers can check the signature.
DMARC
You tell receivers what to do when SPF and DKIM do not line up with the visible "from" domain, and you ask for reports so you can see what is happening.
Worked example
Setting up authentication for a small business domain
A bookkeeping firm sends mail from its hosting mailboxes and also uses an invoicing service that sends reminders in its name. The owner lists both as senders.
The SPF record names the hosting mail server and the invoicing service, and ends with a rule that treats everything else as suspect. DKIM is enabled for the mailboxes, and the invoicing service provides its own DKIM key, which is published too. A DMARC record in monitor mode sends reports to a dedicated address.
After two weeks the reports show every legitimate message passing, plus a handful of failures from servers the firm does not own. These were forgers. The owner moves the DMARC policy to quarantine, then to reject a month later, and customers stop receiving fake invoices in the firm's name.
Glossary
Terms you will meet
| Term | Meaning |
|---|---|
| Alignment | The domain in the visible "from" line matches the domain that passed SPF or DKIM |
| Selector | A label that tells receivers which DKIM key to look up |
| Policy | The DMARC instruction: none, quarantine or reject |
| Aggregate report | A summary of who sent mail for your domain, sent daily by large providers |
| Spoofing | Forging the "from" address of an email |
| Relay | A server that passes mail on to its destination |
Habits
Keeping authentication correct over time
Every time you add a tool that sends email for you, such as a booking system, a newsletter service or a customer help desk, update SPF and set up its DKIM key. Forgetting is the most common reason legitimate mail starts failing.
Review your DMARC reports every month for a while, then every quarter. They show new senders, forged mail attempts and misconfigurations, and they cost nothing but a few minutes of attention.
In summary
The short version to remember
SPF says who may send. DKIM proves a message is genuine. DMARC says what to do if the checks fail and tells you what is going on. Set up all three, start gently, read the reports and tighten over time.
Done well, authentication protects your customers from forged mail in your name and helps your genuine messages reach the inbox. It is one of the cheapest and most effective improvements you can make to business email, and it takes less than an hour for a typical small domain.
If you are unsure about any step, our live chat can look at your records with you.
For team leaders
Make someone responsible
Give one person ownership of your email authentication, and note it in your records. When a new tool is added or a supplier changes, that person updates the records. It is a small job that gets forgotten unless somebody owns it. Put a reminder in the calendar every quarter to read the reports and confirm that every tool sending in your name is still listed in your records.
Email that arrives, on every plan
Spam protection and an external mail relay help your mail reach inboxes.
Set up
Setting them up in order
List every sender
Your mail server, plus any newsletter, booking or invoice service that sends in your name.
Publish SPF
Create one SPF record that includes all of them. A domain should have only one.
Turn on DKIM
Generate the key in your mail system and publish the public key in DNS.
Add DMARC in monitor mode
Start with a policy that only reports, and an address to receive the reports.
Tighten later
When reports show your mail passes, move to a stricter policy.
DMARC policy
The three levels of DMARC policy
A DMARC policy can be set to none, quarantine or reject. With none, receivers only report and treat mail as before. With quarantine, failing mail is usually sent to the spam folder. With reject, it is refused.
Start with none while you collect reports and fix any legitimate sender that fails. Once you are confident, move to quarantine and then reject. Jumping straight to reject can block your own genuine mail if a service you forgot about is not set up correctly.
Common mistakes
What goes wrong with email authentication
Do
- Keep a single SPF record
- Include every service that sends for you
- Start DMARC in monitor mode
- Read the DMARC reports
- Test after every change
Avoid
- Several SPF records on one domain
- Forgetting a newsletter or booking tool
- Going straight to a reject policy
- Ignoring the reports
- Copying records without understanding them
Checking
How to test your records
Send an email from your domain to a test address, such as a personal webmail account, and view the message source. Look for results saying SPF, DKIM and DMARC passed. Many free online tools will also read your DNS and tell you what is missing.
Test again after any change to your mail setup, a new service or a new domain. Authentication is not a one-off job. It needs a quick check whenever the way you send email changes.
FAQ
Common questions
Do I need all three?
Yes, for best results. They work together, and receivers increasingly expect them.
Are these records free?
Yes. They are DNS records, and you add them in your domain's DNS settings.
Will they stop all spam?
They protect others from forged mail in your name. Incoming spam is handled by spam filters, which our plans include.
Can I have two SPF records?
No. A domain should have one SPF record, which lists every sender.
Where do I add them?
In the DNS settings for your domain, as TXT records.
Keep reading
Related pages
Get email that reaches the inbox
Unlimited mailboxes with spam protection and a mail relay.