What are SPF, DKIM and DMARC?
Three DNS records that together decide whether your email arrives and whether anyone can forge it. What each one does, in plain terms.
SPF lists which servers may send email for your domain. DKIM cryptographically signs your messages so tampering is detectable. DMARC ties the two together, tells receivers what to do when they fail, and sends you reports. You need all three.
Why three
Each covers a gap the others leave.
| Record | Proves | Weakness it has |
|---|---|---|
| SPF | The sending server is authorised | Breaks on forwarding; checks the envelope sender, not the visible From address. |
| DKIM | The message is unmodified and from your domain | Says nothing about what to do if the check fails. |
| DMARC | The visible From aligns with an authenticated domain | Depends on SPF or DKIM existing to align against. |
The gap SPF leaves is the important one: it validates the envelope sender, which the recipient never sees. An attacker can pass SPF for a domain they control while displaying your address in the From header. DMARC closes that by requiring alignment with the visible address.
SPF in practice
v=spf1 include:_spf.google.com include:mailgun.org ip4:203.0.113.10 -allinclude:delegates to another domain's SPF, which is how you authorise a provider.ip4:andip6:authorise specific addresses.- Every
include,a,mx,ptr,existsandredirectcosts one of your ten DNS lookups. Large organisations hit this limit routinely and have to flatten their records. - One record only. Two is a permanent error and receivers discard both, leaving you unprotected.
DKIM in practice
Your provider generates a key pair, keeps the private key, and gives you a public key to publish in DNS at a selector:
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq…"Each outgoing message gets a DKIM-Signature header covering the body and selected headers. A receiver fetches the public key at the selector named in the signature and verifies it. Because the signature travels with the message, DKIM survives forwarding, which is where SPF typically fails.
Every service that sends on your behalf needs its own selector and key.
DMARC in practice
v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:reports@example.com; adkim=s; aspf=sp— policy for the domain: none, quarantine or reject.sp— policy for subdomains. Omit it and subdomains inheritp; set it explicitly so nothing is left ambiguous.pct— percentage of failing mail the policy applies to. Useful for phasing in, pointless once you are confident.rua— where aggregate reports go. This is the part with immediate practical value.adkim/aspf— alignment strictness. Relaxed allows subdomains to align; strict requires an exact match.
The reports are the useful part
DMARC aggregate reports arrive as XML from every major receiver, listing who sent mail claiming to be you and whether it authenticated. Two things come out of them:
- Legitimate senders you forgot about, before you enforce a policy that would block them.
- Actual forgery attempts, which tells you whether your domain is being targeted.
What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- SPF record presence, count, all-mechanism and lookup count against the RFC limit.
- DMARC presence, policy, subdomain policy, percentage and reporting address.
- Whether MX records exist, which changes how the mail checks should be read.
- DKIM explicitly reported as untested, with the reason stated rather than guessed at.
For agents and scripts, the same measurement is at
/api/v1/dns?url=yoursite.com —
see the API documentation.
Related questions
Which should I set up first?
DMARC with p=none, immediately — it costs nothing, blocks nothing and starts the reports flowing. Use what the reports tell you to get SPF and DKIM right, then raise the policy.
Can I have two SPF records?
No. Two records is a permanent error under the specification; receivers discard both and you end up with no protection. Merge them into one, combining the include mechanisms.
Does this affect deliverability as well as spoofing?
Substantially. Major providers weigh authentication heavily, and some now require it for bulk senders. Properly authenticated mail is measurably more likely to reach the inbox.
Read next
How do I stop people sending email that looks like it came from my domain?
Three DNS records. Without them anyone can forge your address, including to your own customers — and this applies even if you never send email.
ReadWhat is a CAA record and do I need one?
A DNS record naming which certificate authorities may issue certificates for your domain. One line, and it closes a real gap.
ReadShould I put my email address on my website?
Yes. The spam argument is weaker than it was, and being uncontactable costs more than the spam does.
ReadIs my website secure? How do I check?
What you can verify yourself in twenty minutes, what needs tooling, and what "secure" does and does not mean.
Read