The problem they solve
Email was built without any check on who sends it. Anyone can put billing@yourcompany.com in the From line. Spammers and phishers do exactly that, and receiving mail servers have no way to tell real mail from forged mail unless the domain owner publishes some rules. These three DNS records are those rules.
SPF: which servers may send
SPF (Sender Policy Framework) is a TXT record listing the servers and services allowed to send mail for your domain:
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"The receiving server looks at the address the message actually came from and checks it against this list. SPF checks the envelope sender (the hidden return path), not the From address people see, which is one reason it isn't enough on its own. It also breaks when mail is forwarded, because the forwarding server isn't on your list.
The full syntax, the 10-lookup limit and common mistakes are in SPF record syntax.
DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message's headers. Your mail service signs with a private key, and you publish the matching public key in DNS under a selector:
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."The receiver reads the selector and domain from the signature (s=google; d=example.com), fetches the key and verifies the message. A valid signature proves the message was sent by someone holding your key and was not changed on the way. DKIM survives forwarding, which SPF doesn't.
DMARC: tying it to the visible From address
Neither SPF nor DKIM looks at the From address a reader sees. DMARC (RFC 7489) closes that gap. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From domain (this is called alignment).
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"The record also does two other things:
- Policy (
p=): tells receivers what to do with mail that fails: nothing (none), send it to spam (quarantine) or refuse it (reject). - Reporting (
rua=): asks receivers to send you daily summaries of who sent mail as your domain and whether it passed. These reports show you every service you forgot about.
Tags, alignment modes and the path to enforcement are in what is DMARC.
How they work together
| SPF | DKIM | DMARC | |
|---|---|---|---|
| Checks | Sending server's IP | Message signature | SPF or DKIM, aligned with From |
| DNS record at | yourdomain | selector._domainkey.yourdomain | _dmarc.yourdomain |
| Survives forwarding | No | Usually | If DKIM survives |
| Protects the visible From | No | No | Yes |
Check your domain's SPF record now:
Set them up in this order
- List every service that sends mail as your domain: your mailbox provider, newsletter tool, CRM, helpdesk, billing system, website contact form.
- Publish one SPF record that includes all of them. Check it with the SPF checker.
- Turn on DKIM in each service. Most give you a TXT or CNAME record to add. Confirm with the DKIM checker.
- Publish DMARC with
p=noneand a reporting address. Confirm with the DMARC checker. - Read the reports for two to four weeks. Fix any legitimate source that fails.
- Move to
p=quarantine, thenp=reject.
Setup for your email provider
Exact records and where to find the account-specific values: Google Workspace, Microsoft 365, GoDaddy, Salesforce, Amazon SES, SendGrid, Mailgun, Mailchimp and Cloudflare Email Routing. If something fails, see why DKIM or DMARC fails, and to understand the DKIM part read what is a DKIM selector.
Why it matters now
Since February 2024, Gmail and Yahoo require every sender to have SPF or DKIM, and anyone sending more than 5,000 messages a day to their users to have SPF, DKIM and a DMARC record. Microsoft announced similar rules for Outlook.com in 2025. Mail that doesn't meet them is increasingly sent to spam or rejected.
If your mail already lands in spam, also check whether your sending server's address is on a blocklist with the IP blacklist checker.