SPF, DKIM, and DMARC are three DNS records that together prove your email is genuine, keeping it out of spam folders and stopping others from forging your address. They sound technical, but the idea is simple. This guide explains each in plain language.
SPF: who is allowed to send #
An SPF record lists the mail servers allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from an approved source. A domain should have exactly one SPF record.
DKIM: proof the message is untampered #
DKIM adds a digital signature to your outgoing mail. The receiving server checks it against a public key in your DNS to confirm the message really came from your domain and was not altered in transit.
DMARC: what to do with failures #
DMARC ties SPF and DKIM together and tells receiving servers what to do with mail that fails, from monitor only, to send to spam, to reject. It also sends you reports on who is sending as your domain.
How they work together #
- SPF says which servers may send.
- DKIM proves the message is authentic.
- DMARC sets the policy and gives visibility.
Setting them up #
Each is a DNS record you add to your domain, using the exact values your email provider gives you. Start DMARC in monitor mode, confirm your legitimate mail passes, then tighten the policy.
Need help? #
Our support team can help you build and check these records. Start a live chat and we will assist.
