SPF, DKIM and DMARC Explained

SPF, DKIM and DMARC are three email authentication technologies that help protect your domain from spoofing, improve email deliverability and increase trust with receiving mail providers such as Gmail, Outlook and Yahoo.

If you run a business website, send invoices, receive enquiries through contact forms or use email marketing platforms, understanding these DNS records is essential. Modern email systems increasingly rely on authentication records to determine whether messages should be delivered, filtered into spam folders or rejected completely.

While the names sound technical, the underlying concepts are straightforward. SPF verifies which servers are allowed to send email for your domain, DKIM verifies that email content has not been modified during delivery and DMARC tells receiving mail servers how to handle messages that fail authentication checks.

What is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that specifies which mail servers are authorised to send email on behalf of your domain. When an email arrives claiming to come from your domain, the receiving mail server checks your SPF record to see whether that server is permitted to send mail.

For example, if your business uses Microsoft 365, Google Workspace or a marketing platform such as Mailchimp, those services should be included within your SPF record. If an attacker attempts to send email from an unauthorised server while pretending to be your domain, SPF can help identify the message as suspicious.

One of the most common mistakes is creating multiple SPF records. A domain should only have one SPF record containing all authorised email providers and services.

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email messages. Receiving mail servers use a public key stored in DNS to verify that the message has not been altered after leaving the sender.

Unlike SPF, which validates the sending server, DKIM validates the integrity of the email itself. If the message is modified during transit, the DKIM verification check will fail.

Most modern email providers support DKIM and provide the necessary DNS records automatically. Once configured correctly, DKIM works silently in the background with very little ongoing management required.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds upon SPF and DKIM by defining what should happen when authentication checks fail.

DMARC policies can be configured in three stages:

• None: Monitor authentication failures only.
• Quarantine: Send suspicious messages to spam folders.
• Reject: Refuse messages that fail authentication checks.

DMARC reporting also provides valuable insight into which systems are sending email using your domain, helping identify configuration problems and potential spoofing attempts.

How SPF, DKIM and DMARC Work Together

Together, SPF, DKIM and DMARC form the foundation of modern email authentication. Businesses that correctly implement all three technologies generally benefit from improved deliverability, reduced spoofing risks and greater trust from customers and email providers.

Common SPF, DKIM and DMARC Mistakes

• Creating multiple SPF records.
• Forgetting to enable DKIM after migrating email providers.
• Using a DMARC reject policy before testing legitimate senders.
• Not including third-party email services in SPF records.
• Ignoring DMARC reports.
• Incorrect DNS syntax or formatting.

Before making changes, document your current DNS records and identify every service that sends email using your domain. Small configuration errors can have a significant impact on deliverability.

Checking Your Email Authentication Records

Most domain registrars and hosting providers allow you to view and edit DNS TXT records. DNS lookup tools can be used to verify that SPF, DKIM and DMARC records are published correctly and returning the expected results.

After making changes, allow time for DNS propagation and send test emails to multiple providers such as Gmail and Outlook. Reviewing the authentication results within email headers is one of the best ways to confirm that your configuration is working correctly.