SPF, DKIM and DMARC in plain English
Three DNS records decide whether your email is trusted. What each one does, and how to check yours, without the jargon.
Photo by BiljaST on Pixabay
Anyone can type any "From" address into an email. SPF, DKIM and DMARC are how receiving servers check that a message really came from the domain it claims to. If you send email for a business, you need all three.
SPF: who may send
Sender Policy Framework is a DNS record listing the servers allowed to send mail for your domain. A receiving server checks the sending server's IP against that list.
v=spf1 include:_spf.yourprovider.com ~all
It says "mail from my domain may come from this provider; treat anything else as suspicious." You may have only one SPF record per domain. Two will break it.
DKIM: was it tampered with
DomainKeys Identified Mail adds a cryptographic signature to each message. Your sending platform signs outgoing mail with a private key, and you publish the matching public key in DNS. The receiver checks the signature. If it matches, the message really came from someone holding your key and the signed parts weren't altered along the way.
DMARC: what to do about failures
Domain-based Message Authentication, Reporting and Conformance ties the other two together. It tells receivers:
- the policy:
none(just report),quarantine(send to spam) orreject(refuse) - where to send reports about who is sending mail as your domain
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
DMARC also requires alignment: the domain that passes SPF or DKIM must match the visible From domain.
Roll it out safely
- Set up SPF and DKIM with your sending platform, following their instructions.
- Publish DMARC with
p=noneand read the reports for a few weeks. You will probably find legitimate senders you forgot about. - Fix those, then move to
quarantine, thenrejectwhen you are confident.
Why it matters now
Large mailbox providers require authentication from bulk senders (the Gmail and Yahoo rules), and unauthenticated mail is far more likely to be filtered. Authentication is also your best defence against anyone spoofing your brand.
It's about the sender, not the list
Authentication proves you are who you say you are. It does nothing about the quality of the addresses you send to. You need both: a trusted sender and a clean list (list cleaning guide).
