SPF, DKIM and DMARC are three email authentication standards published in DNS. SPF lists which servers may send for your domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when those checks fail and sends you reports. Gmail and Yahoo require them from bulk senders.
What is SPF?
Sender Policy Framework is a TXT record on your domain that lists the servers and services allowed to send mail for it. A typical record looks like v=spf1 include:_spf.google.com ~all. The receiving server checks the sending IP against it.
Two limits trip people up. A domain can have only one SPF record, and evaluating it may cause at most 10 DNS lookups, so stacking many include: entries can break it. SPF also checks the envelope sender (the Return-Path), not the visible From address, and it often fails when mail is forwarded.
What is DKIM?
DomainKeys Identified Mail signs each outgoing message with a private key. The matching public key sits in a DNS TXT record at a selector, for example selector1._domainkey.yourdomain.com. The receiver verifies the signature, which proves the message was authorized by the domain and was not altered in transit.
Use 2048-bit keys where your provider supports them. Each service that sends for you, such as your email platform, normally gives you its own DKIM record to publish.
What is DMARC?
Domain-based Message Authentication, Reporting and Conformance sits on top of the other two. It is a TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=none; rua=mailto:[email protected].
DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in the visible From address. That match is called alignment. The p= tag sets the policy: none (monitor), quarantine (send to spam) or reject (block). The rua address receives aggregate reports showing who is sending as your domain. A staged rollout is covered in the DMARC policy guide.
How do you set them up?
- List every system that sends mail as your domain: your mailbox provider, marketing platform, CRM, help desk and website forms.
- Add or merge the SPF record so it includes each sender, within the 10-lookup limit.
- Turn on DKIM signing in each sender and publish the DNS records it gives you. In Google Workspace, generate the key in the Admin console and add the TXT record it shows.
- Publish DMARC at p=none with a reporting address.
- Send a test message and confirm SPF, DKIM and DMARC all show PASS in the original message headers.
- Read the reports for a few weeks, fix legitimate senders that fail, then move toward enforcement.
If you send through Gmail's servers, our Gmail SMTP guide covers the connection settings.
Why does this matter for inbox placement?
Without authentication, anyone can forge your domain and providers cannot tell you from an impostor. Since 2024 it is also a requirement: see the Gmail and Yahoo bulk sender requirements. Authentication does not guarantee the inbox, but missing authentication almost guarantees trouble. The wider picture is in email deliverability explained.
Frequently asked questions
Do I need all three of SPF, DKIM and DMARC?
Yes for bulk senders, and it is good practice for everyone. DMARC depends on SPF or DKIM, and having both gives resilience when one breaks, for example SPF during forwarding.
Can I have two SPF records?
No. Multiple SPF records cause a permanent error. Merge all senders into a single record.
What does DMARC alignment mean?
The domain that passed SPF or DKIM must match the domain in the From address, either exactly or, in relaxed mode, at the organizational domain level.
How long do DNS changes take?
Often minutes, but they can take up to the record's TTL, sometimes hours, to be seen everywhere.