SPF, DKIM and DMARC explained
Three DNS records that let receiving mail servers check whether an email really came from the domain it claims. If your app’s emails land in spam, start here.
The problem they solve
Email was designed without any check on who the sender is. Anyone can write any address in the “From” line. SPF, DKIM, and DMARC let a domain owner publish rules that receiving servers use to spot forgeries.
SPF: who may send
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send mail for a domain. The receiving server looks at the domain in the hidden envelope sender, often shown as Return-Path, and checks whether the sending server is on the list.
example.com TXT "v=spf1 include:_spf.mailprovider.com -all"
SPF has a limit of 10 DNS lookups, which is easy to exceed when you add many services. It also breaks when mail is forwarded, because the forwarding server isn’t on your list.
DKIM: a signature on each email
DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your sending service signs it with a private key, and you publish the matching public key in DNS under a name called a selector:
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg…"
If the message is changed on the way, or signed with the wrong key, the check fails. DKIM usually survives forwarding, which is why it matters so much.
DMARC: tying it to the “From” address
SPF and DKIM check domains that readers never see. DMARC (Domain-based Message Authentication, Reporting, and Conformance) adds the rule that matters to people: the domain in the visible “From” address must match, or “align” with, a domain that passed SPF or DKIM. It also tells receivers what to do when that fails.
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
p=none: only send reports. Start here.p=quarantine: put failing mail in spam.p=reject: refuse failing mail.rua=: where daily summary reports are sent.
Why it matters now
Since 2024, Gmail and Yahoo have required bulk senders to set up SPF, DKIM, and DMARC. Even small senders see better inbox placement with all three in place.
Common reasons mail fails
- A new sending service was added but never put in the SPF record.
- Two separate SPF records on one domain. You may only have one.
- DKIM is signed with the sending service’s own domain, so it doesn’t align with your “From” domain.
- Moving straight to
p=rejectbefore checking reports, and blocking your own legitimate mail.
Testing your setup
Send a message to a mailbox that shows full headers and look for spf=pass, dkim=pass, and dmarc=pass in the Authentication-Results header. A temporary inbox is handy for checking that your sign-up emails arrive at all and look right. Temp mail for developers covers what it can and can’t test.