--- title: "SPF, DKIM and DMARC Explained With Setup Steps | Be Efficient" description: "SPF, DKIM and DMARC are the three DNS-based checks that prove an email came from your domain. Learn what each does, how to set them up and how to test." url: https://be-efficient.co/spf-dkim-dmarc-explained site: "be-efficient.co" --- 1. [Home](https://be-efficient.co/) 2. /[Email & Deliverability](https://be-efficient.co/topics/email) 3. /SPF, DKIM and DMARC Explained With Setup Steps [Email & Deliverability](https://be-efficient.co/topics/email) # SPF, DKIM and DMARC Explained With Setup Steps SPF, DKIM and DMARC are the three DNS-based checks that prove an email came from your domain. Learn what each does, how to set them up and how to test. By Itamar HaimPublished November 11, 20263 min read On this page 1. [What is SPF?](#what-is-spf) 2. [What is DKIM?](#what-is-dkim) 3. [What is DMARC?](#what-is-dmarc) 4. [How do you set them up?](#how-do-you-set-them-up) 5. [Why does this matter for inbox placement?](#why-does-this-matter-for-inbox-placement) 6. [Frequently asked questions](#faqs) SPF, DKIM and DMARC are three email authentication standards published in DNS. SPF lists which servers may send for your domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when those checks fail and sends you reports. Gmail and Yahoo require them from bulk senders. ## What is SPF? Sender Policy Framework is a TXT record on your domain that lists the servers and services allowed to send mail for it. A typical record looks like `v=spf1 include:_spf.google.com ~all`. The receiving server checks the sending IP against it. Two limits trip people up. A domain can have only one SPF record, and evaluating it may cause at most 10 DNS lookups, so stacking many `include:` entries can break it. SPF also checks the envelope sender (the Return-Path), not the visible From address, and it often fails when mail is forwarded. ## What is DKIM? DomainKeys Identified Mail signs each outgoing message with a private key. The matching public key sits in a DNS TXT record at a selector, for example `selector1._domainkey.yourdomain.com`. The receiver verifies the signature, which proves the message was authorized by the domain and was not altered in transit. Use 2048-bit keys where your provider supports them. Each service that sends for you, such as your email platform, normally gives you its own DKIM record to publish. ## What is DMARC? Domain-based Message Authentication, Reporting and Conformance sits on top of the other two. It is a TXT record at `_dmarc.yourdomain.com`, for example `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`. DMARC passes when SPF or DKIM passes **and** the domain it authenticated matches the domain in the visible From address. That match is called alignment. The `p=` tag sets the policy: none (monitor), quarantine (send to spam) or reject (block). The `rua` address receives aggregate reports showing who is sending as your domain. A staged rollout is covered in [the DMARC policy guide](https://be-efficient.co/dmarc-policy-guide). ## How do you set them up? 1. List every system that sends mail as your domain: your mailbox provider, marketing platform, CRM, help desk and website forms. 2. Add or merge the SPF record so it includes each sender, within the 10-lookup limit. 3. Turn on DKIM signing in each sender and publish the DNS records it gives you. In Google Workspace, generate the key in the Admin console and add the TXT record it shows. 4. Publish DMARC at p=none with a reporting address. 5. Send a test message and confirm SPF, DKIM and DMARC all show PASS in the original message headers. 6. Read the reports for a few weeks, fix legitimate senders that fail, then move toward enforcement. If you send through Gmail's servers, our [Gmail SMTP guide](https://be-efficient.co/gmail-smtp) covers the connection settings. ## Why does this matter for inbox placement? Without authentication, anyone can forge your domain and providers cannot tell you from an impostor. Since 2024 it is also a requirement: see [the Gmail and Yahoo bulk sender requirements](https://be-efficient.co/gmail-yahoo-bulk-sender-requirements). Authentication does not guarantee the inbox, but missing authentication almost guarantees trouble. The wider picture is in [email deliverability explained](https://be-efficient.co/email-deliverability). ## Frequently asked questions ### Do I need all three of SPF, DKIM and DMARC? Yes for bulk senders, and it is good practice for everyone. DMARC depends on SPF or DKIM, and having both gives resilience when one breaks, for example SPF during forwarding. ### Can I have two SPF records? No. Multiple SPF records cause a permanent error. Merge all senders into a single record. ### What does DMARC alignment mean? The domain that passed SPF or DKIM must match the domain in the From address, either exactly or, in relaxed mode, at the organizational domain level. ### How long do DNS changes take? Often minutes, but they can take up to the record's TTL, sometimes hours, to be seen everywhere. ## On this page 1. [What is SPF?](#what-is-spf) 2. [What is DKIM?](#what-is-dkim) 3. [What is DMARC?](#what-is-dmarc) 4. [How do you set them up?](#how-do-you-set-them-up) 5. [Why does this matter for inbox placement?](#why-does-this-matter-for-inbox-placement) 6. [Frequently asked questions](#faqs) ## Spotted something outdated? Tools and prices change fast. If anything here is wrong or out of date, tell us and we will fix it. [Send a correction](https://be-efficient.co/contact#contact-form) ## Keep reading [More in Email & Deliverability](https://be-efficient.co/topics/email) * Email & Deliverability ### [Email Deliverability: What It Is and How to Improve It](https://be-efficient.co/email-deliverability) Email deliverability is the chance your message lands in the inbox, not spam. See what controls it, how to check yours and what to fix first. November 11, 2026 · 3 min read * Email & Deliverability ### [Email Deliverability Test: How to Check Inbox Placement](https://be-efficient.co/email-deliverability-test) An email deliverability test shows whether your mail reaches the inbox, Promotions or spam. Learn the free checks, seed tests and how to read results. November 11, 2026 · 3 min read * Email & Deliverability ### [How to Improve Email Deliverability: 10 Fixes in Order](https://be-efficient.co/improve-email-deliverability) Improve email deliverability with ten fixes in the right order: authenticate your domain, clean your list, warm up volume and cut complaints. November 11, 2026 · 2 min read ## Contact - Contact form: [Send a message](https://be-efficient.co/contact#contact-form) (we reply by email) - Follow new articles: [RSS feed](https://be-efficient.co/feed.xml)