SPF, DKIM and DMARC Explained: Stop Your Emails Landing in Spam

Three DNS records, each a single line of text, decide whether the email you send actually reaches someone's inbox: SPF, DKIM and DMARC. Get them right and your deliverability is as good as it can be. Get them missing or wrong and legitimate marketing campaigns, invoices and client emails quietly disappear into spam folders — or worse, bounce outright, now that Google and Yahoo both enforce these requirements for anyone sending real volume.

SPF: who's allowed to send as you

SPF (Sender Policy Framework) is a published list of servers authorized to send email on behalf of your domain. It lives as a TXT record and looks something like:

v=spf1 include:_spf.google.com include:sendgrid.net -all

Each include: adds a trusted source — here, Google Workspace and SendGrid — and the -all at the end means "fail anything not explicitly listed." A receiving mail server checks the sending server's IP address against this list; if it's not there, the message looks like it's being spoofed, which is exactly the behavior SPF exists to catch.

Two things trip people up constantly. First, the 10 DNS-lookup limit: SPF allows a maximum of 10 lookups (each include, a, mx, or similar mechanism counts), and exceeding it causes the entire record to fail — silently, with no warning, for every email you send. Second, duplicate records: a domain can only have one SPF record. If your marketing platform and your email provider's setup instructions each told you to add one, you now have two, and most mail servers will treat that as invalid.

DKIM: a cryptographic signature

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email, generated with a private key your mail provider holds and verified against a public key published in your DNS. Unlike SPF, which checks the sending server, DKIM verifies the message content hasn't been altered in transit and that it genuinely came from a server holding your private key.

You don't write a DKIM record by hand — your email provider generates the key pair and gives you an exact TXT record to publish, usually at a selector-specific address like google._domainkey.yourdomain.com. The one common failure mode is setting it up for one sending platform (say, your main email provider) and forgetting to repeat the process for every other tool that sends on your behalf — your CRM, your invoicing software, your marketing platform. Each needs its own DKIM setup if it sends as your domain.

DMARC: the policy that ties them together

DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of both SPF and DKIM and does two things: it tells receiving servers what to do when a message fails authentication, and it gives you visibility into who's sending email as your domain — including anyone spoofing it.

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

The p= tag is the policy: none monitors without taking action (the safe starting point), quarantine sends failures to spam, and reject blocks them outright. The rua= address is where aggregate reports get sent — daily or weekly summaries of every server that tried to send as your domain, which is often the first time a business discovers exactly how much spoofing or shadow-IT email sending has been happening under their name.

Tip Don't jump straight to p=reject. Set p=none first, let reports come in for a couple of weeks, confirm every legitimate sending source (your main inbox, your CRM, your marketing and invoicing tools) is passing both SPF and DKIM, and only then tighten the policy. Going straight to reject before verifying every sender is the single most common way businesses accidentally block their own email.

How these three work together

SPF and DKIM are independent checks — a message only needs to pass one of them to satisfy DMARC's default alignment requirement, though passing both is stronger. DMARC's real job is deciding what happens on failure, and giving you reporting so you're not operating blind. Think of it as: SPF says who's allowed to send, DKIM proves the message wasn't tampered with, and DMARC says what to do when either check fails — plus who to tell about it.

Checking your current setup

Misconfigurations here are common precisely because they're invisible until something breaks — a passing SPF check with a hidden duplicate record, a DKIM key that was never actually activated, a DMARC policy stuck at p=none since the day it was set up. Our free SPF record reviewer catches the specific mistakes above (too many lookups, duplicate records, a missing or weak all mechanism) directly from a pasted TXT record, and the DNS & email health checker pulls your actual public MX, SPF and DMARC records in one pass so you can see exactly what's live right now.

Email deliverability is foundational to everything else in digital marketing — see our email marketing automation playbook for the campaign side once your sending infrastructure is solid, and our digital marketing services if you'd like your entire sending setup audited and fixed properly.