If your legitimate emails keep landing in customers’ spam folders, or worse, if scammers are sending fake emails that appear to come from your domain, the fix almost always lives in three small DNS records: SPF, DKIM, and DMARC. Together they are email authentication — the mechanism that lets receiving mail servers verify that a message really came from you and wasn’t forged. They are free to set up, and getting them right protects both your deliverability and your brand. This guide explains what each one does and how they work together.
The problem they solve
Email was designed in an era of trust, so by default anyone can send a message claiming to be from any address — including yours. This is what makes spoofing and much phishing possible. Email authentication closes that gap by giving receiving servers a cryptographic and policy-based way to check whether a message is genuinely authorized to use your domain.
SPF, DKIM, and DMARC at a glance
| Record | What it checks | In plain terms |
|---|---|---|
| SPF | Which servers may send for your domain | “These are my authorized post offices” |
| DKIM | A cryptographic signature on the message | “This letter has my tamper-proof seal” |
| DMARC | What to do if SPF/DKIM fail, plus reporting | “If it fails the checks, here’s what to do — and tell me” |
SPF: authorizing your senders
SPF (Sender Policy Framework) is a TXT record listing every server and service allowed to send email using your domain — your mail provider, plus any marketing, CRM, or invoicing tools that send on your behalf. Receiving servers check whether the sending server is on that list. The most common SPF mistake is forgetting a legitimate service, which causes real mail to fail; the second is exceeding the limit on lookups, which invalidates the whole record. Every sending source must be accounted for.
DKIM: the tamper-proof signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message using a private key held by your mail server, which receivers verify against a public key published in your DNS. This proves two things: the message really came from your domain, and it wasn’t altered in transit. Your mail provider generates the keys; you publish the public one as a DNS record. Once set up, it works invisibly on every message.
DMARC: the policy and the reports
DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails: do nothing (monitor), quarantine it to spam, or reject it outright. Crucially, DMARC also sends you aggregate reports showing who is sending mail using your domain — including impersonators — which is invaluable visibility. The recommended path is to start at p=none to observe, review the reports, fix any legitimate senders that are failing, then gradually tighten to quarantine and finally reject once you are confident.
The right order to deploy
- Inventory every sender — every tool and service that sends mail as your domain.
- Publish SPF covering all of them.
- Enable DKIM with your mail provider and publish the key.
- Publish DMARC at p=none and collect reports.
- Fix failures revealed by the reports.
- Tighten DMARC to quarantine, then reject.
Why this matters more than ever
Major mailbox providers have made email authentication effectively mandatory for bulk senders, and increasingly weigh it for everyone. Domains without proper SPF, DKIM, and DMARC face worse deliverability and are far easier to impersonate. Setting these up is no longer optional hygiene — it is table stakes for reliable business email.
Frequently Asked Questions
Do I need all three, or is one enough?
You need all three. SPF and DKIM each prove different things, and DMARC only works when at least one of them passes and aligns. Together they provide meaningful protection; alone, each has gaps.
Will enabling DMARC reject block my own emails?
Not if you deploy it correctly. Starting at p=none and reviewing reports ensures every legitimate sender passes before you enforce. Rushing straight to reject is the mistake to avoid.
Protect your domain and your deliverability
Correct email authentication keeps your mail out of spam and stops criminals impersonating your brand. For help auditing and deploying SPF, DKIM, and DMARC safely, contact our engineers, or read our DNS explained for business guide, since these records all live in DNS.