The three DNS records that protect your email from spoofing and stop legitimate emails landing in spam, explained without the jargon.
Email was designed in the 1970s with no way to verify who sent a message. Anyone can send an email claiming to be from [email protected], including scammers running phishing attacks against your customers or staff.
SPF, DKIM, and DMARC are three DNS records that work together to fix this. They let receiving mail servers verify that an email really came from you, and tell them what to do if it did not.
In 2024, Google and Yahoo made these records mandatory for bulk senders. Without them, your emails risk being rejected or landing in spam, even for people you email regularly.
Frequently asked questions
An SPF record is a DNS TXT record that lists every mail server authorised to send email on behalf of your domain. When a recipient's server receives a message from you, it checks your SPF record to see if the sending server is on the list.
Example: v=spf1 include:_spf.google.com ~all
This tells receiving servers: "Only Google's mail servers are authorised to send on my behalf. Treat anything else as a soft fail."
| Modifier | Name | Effect on unlisted senders |
|---|---|---|
-all | Strict / Fail | Rejected outright |
~all | Soft fail | Flagged but usually delivered |
?all | Neutral | No enforcement (not recommended) |
+all | Pass all | Any server can send (dangerous, avoid) |
The SPF specification limits how many DNS lookups a mail server will perform when evaluating your record to 10. Each include: directive counts as a lookup, and nested includes count too.
If your SPF record requires more than 10 lookups, receiving servers may mark it as a "PermError" and treat it as a failed check, even if the sending server is legitimately authorised. This is a common problem for businesses using multiple email services (for example: Google Workspace, HubSpot, Mailchimp, and Xero all together). The fix is called "SPF flattening": replacing include: entries with the underlying IP addresses.
DKIM adds a cryptographic signature to every outgoing email. Your mail server signs the message using a private key, and publishes the matching public key in a DNS TXT record. When the recipient's server receives the email, it fetches your public key and uses it to verify the signature.
This proves two things: the email genuinely came from a server that controls your domain, and the message was not tampered with in transit.
A DKIM selector is a short label that identifies which key to use. It forms part of the DNS record name: <selector>._domainkey.yourdomain.com. You can have multiple selectors, which is useful when you use several email services. Google Workspace uses the selector google, while Microsoft 365 typically uses selector1 and selector2.
"Pending activation" means the DNS record exists but the service has not started signing messages yet. This usually happens because the CNAME was recently added and the provider has not detected it yet, or there is a configuration step still needed in the provider's control panel.
DMARC is the policy layer that sits on top of SPF and DKIM. It tells receiving mail servers what to do when an email fails both SPF and DKIM checks:
| Policy | Effect |
|---|---|
p=none | Monitor only. No action taken, but reports are sent. |
p=quarantine | Suspicious emails go to the spam or junk folder. |
p=reject | Failing emails are outright rejected. |
DMARC also includes an optional rua= tag that gives you an email address to receive aggregate reports, showing you everything being sent from your domain including phishing attempts.
Yes. They serve complementary roles: SPF verifies the sending server, DKIM verifies the message content and sender, and DMARC defines what happens when either check fails and gives you visibility into who is sending email using your domain. Having only one or two leaves gaps that attackers or misconfigured systems can exploit.
It is one of the most impactful things you can do. Missing or misconfigured authentication records are a major spam signal. Correctly configured SPF, DKIM, and DMARC will not guarantee every email reaches the inbox (content, reputation, and list hygiene also matter), but they are a prerequisite for good deliverability.
A blacklist (or blocklist) is a database of IP addresses or domains known to send spam. If your domain or mail server IP appears on a major blacklist, your emails may be rejected or filtered regardless of your SPF, DKIM, and DMARC configuration. You can check your blacklist status using MX Toolbox.
Check your domain's SPF, DKIM, and DMARC configuration now. Free, no account needed.
Got an SPF, DKIM, or DMARC issue you can't crack? Or emails landing in spam? Get personalised advice from an email security and deliverability specialist.