SPF, DKIM, and DMARC Explained: The DNS Records That Fix Email Deliverability

SPF, DKIM and DMARC are three DNS records that together prove your email is genuinely from you — which is what keeps it out of the spam folder and stops others spoofing your domain. They work as a layered system, and understanding each is the key to fixing deliverability. For the practical setup, see adding SPF, DKIM and DMARC records.

SPF: who is allowed to send

An SPF record is a TXT record listing which mail servers are authorised to send email for your domain. A receiving server checks whether the sending server is on that list. If not, the message looks forged. The catch is a strict limit on DNS lookups — see building a correct SPF record.

DKIM: a tamper-proof signature

DKIM adds a cryptographic signature to each outgoing message's headers. Your public key is published in DNS, and the receiver uses it to confirm the message really came from your domain and was not altered in transit. See setting up DKIM signing.

DMARC: policy and alignment

DMARC ties the two together. It tells receivers what to do with mail that fails SPF and DKIM — nothing, quarantine, or reject — and it adds alignment, requiring that the domain checked by SPF/DKIM matches the visible "From" address. It also sends you reports on who is sending as your domain. See deploying DMARC.

Why all three together

• SPF alone can be bypassed (it does not check the visible From, and breaks on forwarding).
• DKIM alone proves integrity but not policy.
• DMARC enforces alignment and gives you visibility and control.

Missing or misconfigured, these are the most common reason legitimate mail is marked as spam — see why emails go to spam.

Frequently asked questions

Do I need all three, or is one enough?

You want all three. SPF and DKIM each cover part of the picture, and DMARC binds them with alignment and reporting. Together they give receivers a clear, trustworthy signal that your mail is legitimate.

Which one stops others spoofing my domain?

DMARC with an enforcing policy is what actually tells receivers to reject spoofed mail claiming to be from you — but it relies on SPF and DKIM being correctly set up first.

Why is my mail still going to spam with SPF set?

SPF alone is often not enough — you likely also need DKIM and a DMARC policy, plus good reverse DNS and sending reputation. Deliverability is a combination, not a single record.