SPF, DKIM and DMARC: protect your email from spoofing and spam folders

Anyone can write your address in the "From" field of an email. The email system was built without a way to check who the sender really is. SPF, DKIM and DMARC are three settings in your domain's DNS that fix this: they let the receiving mail server check that a message really comes from you.

Without them, your emails are more likely to land in spam, and criminals can send fake invoices and messages in your name, which damages the trust of your customers.

What each one does

• SPF is a list of servers that are allowed to send email for your domain. The receiver checks whether the sending server is on the list, like checking a name on a guest list.
• DKIM adds a digital signature to every message. The receiver checks the signature with a public key published in your DNS and sees that the message really came from your system and was not changed on the way, like a seal on an envelope.
• DMARC is the policy that ties them together. It tells receivers what to do if the checks fail (accept, send to spam or reject) and sends you reports about who is sending email in your name.

They work together. Using only one leaves gaps.

Why it matters

• Better delivery: a higher chance that your emails reach the inbox instead of spam.
• Protection against fraud: it is much harder to send fake emails that pretend to be you.
• Requirements: large providers such as Gmail and Yahoo require these records from anyone who sends in bulk, and messages without them can be rejected.
• Visibility: DMARC reports show you every service that sends email as your domain, including ones you forgot about.

How to set them up

You change these records where your domain's DNS is managed (often your domain registrar or hosting company). If you are not sure, ask your IT supplier to do it, it usually takes under an hour.

Step 1. SPF

Add a TXT record to your domain that lists every service that sends email for you: your mail provider, your newsletter tool, your CRM, your web shop. Example:

v=spf1 include:_spf.your-mail-provider.com include:mail.your-newsletter-tool.com ~all

Have only one SPF record per domain. Two records break the check.

Step 2. DKIM

Turn on DKIM in your mail service and in every other service that sends email for you. Each one gives you a key to publish in DNS as a TXT (or CNAME) record. Publish them exactly as shown.

Step 3. DMARC

Start gently, with monitoring only:

v=DMARC1; p=none; rua=mailto:[email protected]

After a few weeks, when the reports show that all your legitimate email passes, tighten the policy to p=quarantine (suspicious messages go to spam) and later to p=reject (they are refused). Going straight to reject without monitoring can block your own newsletters.

How to check that it works

• Send a test message to a free checker such as mail-tester.com and read the report.
• Use a DNS lookup tool to confirm that the SPF, DKIM and DMARC records exist and have no errors.
• Open the "show original" view of a message you received from your domain and look for spf=pass, dkim=pass and dmarc=pass.

Common mistakes

• Two SPF records instead of one.
• Forgetting a service that sends email for you, so its messages fail the check.
• Jumping straight to p=reject without monitoring first.
• Never reading the DMARC reports. They arrive as technical XML files, so use a free reader or a service that turns them into a simple overview.
• Setting up only SPF and thinking the job is done.

Frequently asked

Do I need all three? Yes. Each covers a different weakness, and DMARC needs SPF or DKIM to work.

Will it improve delivery? It does not guarantee the inbox, but without it you start with low trust. With it, other good practices (a clean list, relevant content) can do their work.

What if I send from several tools? Add each tool to SPF and enable DKIM in each of them.