13 d up · CPU 17% · RAM 44% · Storage 20% All systems operational 99.79% uptime (30 days) View status →
Guides

SPF, DKIM and DMARC explained

Anyone can put any sender address in an email. That’s how phishing works: a message that appears to come from your bank, or from your domain. SPF, DKIM and DMARC are three settings in your DNS that let a receiver check whether an email was really sent on behalf of your domain. If you have your own domain, you want all three set up properly, even if you hardly send any mail with it yourself.

You can check them all at once with our Email Check. Below you’ll read what each part does.

SPF: which servers may send mail?

SPF (Sender Policy Framework) is a TXT record on your domain with a list of the servers that may send mail on your behalf. A receiver checks whether the server that delivers the mail is on that list.

example.com.  TXT  "v=spf1 mx include:spf.mymailprovider.com -all"

This is how you read it:

  • v=spf1: this is an SPF record.
  • mx: the domain’s own mail servers may send.
  • ip4:203.0.113.10: a fixed IP address may send (not used here, but you often see it).
  • include:...: another party’s list counts too, for example your mail provider or newsletter service.
  • -all: reject everything that isn’t on the list. With ~all (softfail) the receiver marks it as suspicious but doesn’t necessarily reject it. ?all means “no opinion”.

Note:

  • You may only have one SPF record per domain. Two records cause an error, and then SPF doesn’t work at all.
  • An SPF check may do at most 10 DNS lookups (through include, a, mx and similar). Stack too many services and the check fails.
  • SPF looks at the technical sender address (the envelope sender), not the address the reader sees as “From”.
  • With forwarding, SPF often breaks: the forwarding server isn’t on your list.

DKIM: a signature under the mail

With DKIM (DomainKeys Identified Mail), the sending server puts a digital signature in the header of every email. It makes it with a private key that only it has. The matching public key is in your DNS. The receiver fetches it and checks that the mail hasn’t been changed on the way and really comes from your domain.

The key is stored under a name with a selector, which your mail provider chooses:

selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

You usually turn DKIM on in your mail provider’s admin panel, which tells you which record to create. In the mail header you’ll see it as DKIM-Signature: ... d=example.com; s=selector1; .... The advantage over SPF: a DKIM signature usually stays valid when mail is forwarded.

DMARC: what should the receiver do when a check fails?

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It does two things:

  1. It requires that SPF or DKIM not only passes, but also matches the “From” address that the reader sees (alignment).
  2. It tells the receiver what to do with mail that fails, and where to send a report.

The record lives at _dmarc:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
  • p=none: do nothing, just send reports. This is where you start.
  • p=quarantine: put failing mail in spam.
  • p=reject: refuse failing mail.
  • rua=mailto:...: the address where daily summaries go.

In what order do you turn it on?

  1. Take stock of who sends mail on behalf of your domain: your mail provider, a newsletter service, your website, a printer, Home Assistant or another server.
  2. Set up SPF and DKIM properly for all of those senders.
  3. Turn on DMARC with p=none and read the reports for a few weeks. You’ll then see which senders still aren’t right.
  4. Tighten to quarantine, and once everything is right to reject.

If you reverse that order, you risk having your own, legitimate mail suddenly rejected.

Checking it yourself

The quickest way is the Email Check. If you want to see the records yourself, you can use the DNS Lookup (choose TXT) or the command line:

dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com

To find out who a domain is registered with or where the name servers are, see Whois and domain info.

Common mistakes

  • Two SPF records after adding a new service. Add the include to the existing record.
  • Forgetting a sender (the newsletter, the invoicing software). Their mail will then look suspicious.
  • Setting p=reject right away without reading reports first.
  • Not publishing the DKIM record after turning it on at the provider.
  • Expecting this to stop spam. It protects against misuse of your domain, it doesn’t filter incoming spam.

Large mail providers such as Google and Yahoo have asked, since 2024, that anyone sending a lot of mail has SPF, DKIM and DMARC in order. Even if you send little mail, it helps keep your mail from ending up in spam.