SPF, DKIM, DMARC Explained (With Example Records)
SPF, DKIM, DMARC: these are three DNS-based standards that let mailbox providers check whether an email claiming to be from your domain really is. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature to each message. DMARC ties the two to the visible From address, tells receivers what to do when a message fails, and sends you reports. Together, SPF, DKIM and DMARC are now the minimum for reliable inbox placement.
Why SPF, DKIM and DMARC matter
Since February 1, 2024, Gmail has required senders of 5,000 or more messages a day to personal Gmail accounts to set up SPF, DKIM and DMARC (Google). Yahoo began enforcing similar rules in February 2024 (Yahoo Sender Hub), and Microsoft announced matching requirements for Outlook.com consumer domains in 2025 (Microsoft).
- 5,000+ messages a day to personal Gmail accounts makes you a bulk sender Google, 2024
- 0.30% spam rate in Postmaster Tools that bulk senders must stay below (Google advises under 0.10%) Google, 2024
- 1024-bit minimum DKIM key length for personal Gmail accounts; 2048-bit recommended Google, 2024
Even below 5,000 a day, unauthenticated mail is more likely to land in spam, and your domain is easier to spoof in phishing attacks. It is the first thing we check in any email marketing engagement.
How SPF, DKIM, DMARC work together
| Standard | DNS record (example) | What it checks | Watch out for |
|---|---|---|---|
| SPF | v=spf1 include:_spf.google.com include:sendgrid.net -all on the root domain |
The sending server’s IP is listed | Max 10 DNS-querying lookups, or SPF returns permerror (RFC 7208) |
| DKIM | A public key at selector._domainkey.example.com |
The signature matches, so the message wasn’t altered | Each sending tool needs its own selector and key |
| DMARC | v=DMARC1; p=none; rua=mailto:dmarc@example.com at _dmarc.example.com |
SPF or DKIM passes and aligns with the From domain | p=none only monitors; it doesn’t protect |
Alignment is the part people miss. A newsletter tool can pass SPF for its own domain, but DMARC only passes if the passing domain matches your From domain. That’s why each tool in your email marketing stack needs a custom DKIM domain or custom return-path.
DMARC policies (RFC 9989, which replaced RFC 7489 in May 2026):
- p=none: monitor only. Receivers deliver as normal and send you reports.
- p=quarantine: treat failing mail as suspicious, usually sending it to spam.
- p=reject: treat failing mail as invalid; receivers may refuse it.
RFC 9989 also removed the old pct tag and added a t (test mode) tag, though existing v=DMARC1 records keep working.
Example: auditing a typical B2B domain
A hypothetical company sends from Google Workspace, HubSpot, Zendesk and an invoicing tool. Their SPF record has 4 includes, but HubSpot’s and Zendesk’s includes nest further lookups, bringing the total to 12. SPF fails with permerror for everyone.
The fix: remove the invoicing tool’s include (it sends from its own domain), and authenticate HubSpot with DKIM on a subdomain instead of SPF on the root. Lookups drop to 8. DMARC aggregate reports then show all four tools passing aligned DKIM, so the team moves from p=none to p=quarantine, and six weeks later to p=reject.
Email authentication is one of the first things I check when a client says their emails go to spam. It's rarely glamorous: a forgotten tool sending on the root domain, or a DMARC record left at p=none for years. Get the reports flowing, list every service that sends as you, and tighten the policy only once each one passes.
How to set up SPF, DKIM and DMARC
-
List every sender
Workspace or Microsoft 365, CRM, newsletter, help desk, billing, website forms. Ask finance and support too.
-
Publish one SPF record
One TXT record per domain, includes for tools that need it, ending in -all or ~all, under 10 lookups.
-
Turn on DKIM everywhere
Generate keys in each tool (2048-bit where supported) and publish the CNAME or TXT records it gives you.
-
Start DMARC at p=none
Add rua reporting so you see who is sending as you.
-
Read the reports for 2–4 weeks
Fix every legitimate sender that fails alignment.
-
Tighten the policy
Move to p=quarantine, then p=reject once reports are clean. That also makes you eligible for BIMI.
Myth vs fact
- Mythp=none means you're protected by DMARC.
- Factp=none only asks for reports. It meets Gmail's minimum, but spoofed mail is still delivered. Protection starts at p=quarantine or p=reject.
Authentication gets you through the door. Reputation keeps you there, which is where email warm-up and list hygiene come in.
Frequently asked questions
Do I need all three: SPF, DKIM and DMARC?
Yes, if you send marketing or bulk email. Gmail, Yahoo and Outlook.com require all three for high-volume senders, and DMARC can't pass reliably without SPF or DKIM aligned to your From domain.
What DMARC policy should I start with?
Start with p=none and a rua reporting address. Use the reports to find and fix every legitimate sender, then move to p=quarantine and p=reject. Jumping straight to reject can block your own invoices or support replies.
Why does my SPF record fail with too many lookups?
SPF allows a maximum of 10 DNS-querying mechanisms, and nested includes count. Remove senders you no longer use, move some tools to DKIM-only on a subdomain, or use separate subdomains for marketing mail.
Can I have two SPF records?
No. A domain must publish one SPF record. Two records cause a permanent error. Merge all includes into a single record.