What Are SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are three DNS records that prove an email really came from your domain, so it reaches the inbox instead of the spam folder. SPF lists the servers allowed to send for you, DKIM adds a tamper-proof signature, and DMARC sets the rule for messages that fail. Since February 2024, Google and Yahoo require all three from bulk senders.

What does each record do?

Each record answers a different question a receiving mail server asks before it trusts your message. Together they replace blind trust with proof.

SPF, the Sender Policy Framework, is a DNS TXT record that lists the servers authorized to send email for your domain (Cloudflare, accessed August 2026). If a message arrives from a server not on the list, it fails SPF. The specification is RFC 7208.

DKIM, DomainKeys Identified Mail, adds a digital signature using public-key cryptography (Cloudflare, accessed August 2026). The signature proves the message came from your domain and was not altered on the way, like a tamper-proof seal on a medicine bottle. Its specification is RFC 6376.

DMARC, Domain-based Message Authentication, Reporting, and Conformance, ties the first two together. A DMARC policy tells the receiving server what to do (Cloudflare, accessed August 2026) when a message fails SPF and DKIM. It also sends you reports on who is sending mail using your name, and its specification is RFC 7489.

Record	Question it answers	DNS type
SPF	Which servers may send for this domain?	TXT
DKIM	Was this message signed by the domain, and unchanged?	TXT
DMARC	What happens to mail that fails SPF and DKIM?	TXT

Source: SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489).

How do the three work together?

The three run as a sequence on every message you send. A receiving server checks SPF and DKIM, then applies your DMARC policy to the result.

First it checks SPF: did the message come from an approved server?

Then it checks DKIM: is the signature valid and the message unchanged?

DMARC then decides the outcome. It also requires that the domain passing SPF or DKIM matches the domain in the visible From address, a match called alignment.

Your DMARC policy takes one of three values. Most domains start at the safest one and tighten later.

p=none monitors and reports but still delivers failing mail. p=quarantine sends failing mail to spam. p=reject blocks it outright.

The usual path is to begin at none, read the reports, then move to quarantine or reject once every real sender is covered.

Do you actually need all three?

Yes, if you want your email to land reliably and to stop others spoofing your name. Google's sender rules make this concrete.

Google's Email sender guidelines say every sender must use SPF or DKIM, and bulk senders must set up all three (Gmail Help, accessed September 2026). Yahoo's sender best practices set the same rule for bulk senders from February 2024. A bulk sender is anyone sending more than 5,000 messages a day to Gmail. Since 1 February 2024, those senders also need DMARC, even at p=none.

Most small businesses never hit 5,000 messages a day. The rule still matters anyway.

Inboxes increasingly treat authentication as a trust signal for every sender, not only bulk ones. Mail without it is more likely to be filtered, whether it runs on your web host or a dedicated email service such as Microsoft 365 or Google Workspace.

When invoices start landing in spam, check first whether SPF and DKIM exist at all; domains set up years ago may never have had them. Adding them means editing the domain's DNS, and in our experience that is where many owners stall, because they don't know who holds the domain account.

What happens when they are missing or wrong?

Missing records let anyone send mail that appears to come from your domain, and they push your real mail toward spam. Both problems cost you directly.

Spoofing is the first risk. Without DMARC set to quarantine or reject, a scammer can forge your address in a phishing email to your own customers. They can also run one from a compromised inbox using a stolen login.

With no SPF or DKIM, your genuine mail also looks less trustworthy, so it lands in spam or is rejected. That is the same problem we cover in why business emails land in spam.

A common mistake is setting the records once and forgetting them. Add a new tool that sends mail for you, such as a newsletter service or a booking system, and it will fail SPF until you authorize it.

The records live with your domain, not your website. That is why they survive a website redesign untouched.

Frequently asked questions

Are SPF, DKIM, and DMARC free to set up?

Yes. All three are DNS records, so there is no license or product to buy. You add them in your domain's DNS settings, the same place your DNS records live. The only cost is the time to configure them correctly, or a small fee if a provider does it for you. The records themselves cost nothing and renew with the domain.

Do I need all three if I only send a few emails a day?

Usually yes, even below the bulk-sender limit. SPF and DKIM are the minimum that inbox providers now expect from any domain, and DMARC protects your name from being forged. A small business sending a handful of messages still benefits, because the records decide whether those few messages reach the inbox or the spam folder.

What is the difference between SPF and DKIM?

SPF checks the sending server; DKIM checks the message itself. SPF lists which servers may send for your domain, so it fails if mail comes from an unlisted server. DKIM adds a cryptographic signature that proves the message content was not altered in transit. They cover different gaps, which is why inbox providers want both rather than either one alone.

Will setting up DMARC block my own emails?

Not if you configure it in the right order. Start with p=none, which only monitors and reports, so nothing is blocked while you read the reports. Once you confirm every legitimate sender passes SPF or DKIM, you raise the policy to quarantine or reject. Jumping straight to reject before checking is what accidentally blocks real mail.

Where do I add these records?

You add all three in your domain's DNS, through your registrar or hosting control panel. Each is a TXT record with a specific format that your email provider supplies. Google Workspace and Microsoft 365 both give you the exact values to paste. If your email and website use different providers, the records still live with the domain.

Getting your email trusted from the start

Storming Solutions builds and maintains websites for Malaysian businesses, and setting up email authentication is part of how we hand a site over. We configure SPF, DKIM, and DMARC so your mail reaches customers and nobody can send in your name, and we register the domain in your name, not ours.

Not sure whether your email is authenticated, or watching your messages land in spam? Ask on WhatsApp or read why a business pays for email, then talk to us about web development.