SPF, DKIM and DMARC: Email Deliverability Explained

If legitimate business email is landing in spam, or a domain seems easy for scammers to impersonate, the cause is usually the same: missing or incomplete SPF, DKIM and DMARC records. These three DNS entries work together to prove a message really came from the domain it claims to, and mailbox providers increasingly expect all three before trusting a sender.

SPF: which servers are allowed to send

SPF, short for Sender Policy Framework, is a DNS record listing which mail servers are authorized to send email on behalf of your domain. When a message arrives, the receiving mail server checks whether it came from a server on that approved list. If it didn't, the message looks suspicious, even if the content is legitimate.

A domain typically needs exactly one SPF record, listing every service that sends mail as that domain: your hosting provider's mail servers, plus anything else that sends on your behalf such as a marketing platform or a helpdesk tool. Adding a second, separate SPF record instead of extending the first one is a common mistake, and it breaks the check entirely.

DKIM: proving the message was not altered

DKIM, DomainKeys Identified Mail, adds a digital signature to outgoing messages using a private key that only your mail server holds. The receiving server checks that signature against a public key published in your DNS. If the message matches, it confirms both that it genuinely came from an authorized source and that its content was not modified in transit.

Your hosting provider usually generates the DKIM key pair automatically when a mailbox is created and gives you the DNS record to publish. Once published, DKIM works silently in the background with no ongoing maintenance needed unless you change mail providers.

DMARC: telling receivers what to do with failures

SPF and DKIM each check a different thing, but neither one tells a receiving mail server what to actually do when a message fails the check. That is DMARC's job. A DMARC record states a policy: monitor only, quarantine failing messages into spam, or reject them outright, and gives an address where reports about failures are sent.

• p=none — monitor and collect reports without affecting delivery, a sensible starting point.
• p=quarantine — send failing messages to spam instead of the inbox.
• p=reject — block failing messages from being delivered at all.

Why all three matter together

SPF alone can be bypassed by forwarding quirks. DKIM alone does not tell a receiver what policy to apply on failure. DMARC alone has nothing to build its policy on without SPF and DKIM already in place. Mailbox providers such as Gmail and major business email services now expect all three configured correctly, particularly for domains sending any volume of outbound mail, and increasingly reject or heavily filter mail from domains missing them.

How to check your current setup

Several free online tools will check a domain's SPF, DKIM and DMARC records and report whether they are present, correctly formatted and aligned with each other. Run a check after any change to mail providers, since adding a new sending service without updating SPF is one of the most common causes of records quietly going out of date.

Setting these up on a hosting account

If domain email is hosted with your web hosting provider, SPF and DKIM values are usually generated automatically when the mailbox or email service is activated, and shown in the hosting control panel's DNS or email settings. DMARC is typically a manual addition: a single TXT record you create yourself once SPF and DKIM are confirmed working. See our guide on setting up professional email on your own domain for the mailbox setup steps that come before this.

A short verification checklist

• Confirm one, correctly formatted SPF record covering every service that sends mail as your domain.
• Confirm DKIM is published and signing outgoing mail.
• Add a DMARC record starting at p=none and review the reports it generates.
• Re-check all three after adding any new email-sending tool or service.
• Move DMARC to quarantine, then reject, only once reports show no legitimate mail failing.

None of these records need to be revisited often once correctly set up. The effort is front-loaded: get SPF, DKIM and DMARC right once, and business email keeps landing where it is supposed to without further attention.