SPF, DKIM and DMARC are three DNS records that prove email really comes from your domain. SPF lists the servers allowed to send, DKIM signs each message, and DMARC tells receiving servers what to do when a message fails and where to send reports. A domain with all three, plus working MX records, is far more likely to reach the inbox and much harder to spoof.
How do SPF, DKIM and DMARC work together?
- SPF (RFC 7208) is a TXT record that lists the mail servers and services allowed to send email for your domain.
- DKIM (RFC 6376) adds a digital signature to every message. Receivers check it against a public key published in your DNS under a selector name.
- DMARC (RFC 7489) ties them together. It requires SPF or DKIM to pass and align with the visible From address, sets a policy for failures and sends you reports.
What does a healthy email DNS setup look like?
This example uses reserved example.com names. Your values come from your email provider.
example.com. MX 10 mx1.mailhost.example.
example.com. TXT "v=spf1 include:_spf.mailhost.example ~all"
selector1._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"What do Google, Yahoo and Microsoft require?
Since February 2024, Google and Yahoo require anyone who sends more than 5,000 messages a day to their users to authenticate with SPF and DKIM, publish a DMARC policy and offer one-click unsubscribe on marketing mail. Microsoft introduced comparable requirements for high-volume senders to Outlook.com in 2025. Smaller senders benefit too, because authenticated mail is trusted more and lands in the spam folder less often.
What is the SPF 10-lookup limit?
RFC 7208 allows an SPF check to trigger at most 10 DNS-querying terms (include, a, mx, ptr, exists and redirect), counted through every nested include. Going over returns a PermError and SPF fails. Fix it by removing services you no longer use or by replacing includes with fixed ip4 ranges.
What do DMARC policies mean?
| Policy | What receivers do | When to use it |
|---|---|---|
p=none | Deliver the mail but send you reports. | Start here to see who sends mail as your domain. |
p=quarantine | Send failing mail to the spam folder. | Once your legitimate senders all pass. |
p=reject | Refuse failing mail. | The strongest protection against spoofing. |