SPF, DKIM and DMARC, in plain English

When a customer says “your email went to my spam folder,” the cause is usually three short lines of text you have never seen. They sit in your domain’s DNS settings, the same place that points your web address at your website. Mail providers read them on every message you send to decide whether it really came from you.

The three are called SPF, DKIM and DMARC. Here is what each one does.

SPF: the list of who may send for you

SPF (Sender Policy Framework) is a list of the mail servers allowed to send email for your domain. If you use Google Workspace, the list says “Google may send for this domain.” If you also send invoices from QuickBooks or newsletters from Mailchimp, those services need to be on the list too.

When a message arrives claiming to be from you, the receiving server checks whether it came from a server on the list. If not, that counts against it.

The most common mistake is having two SPF records. A domain may have only one, and when there are two, receivers treat SPF as broken. Each new service you sign up with tells you to “add an SPF record”, and it is easy to end up with several. They need to be merged into one.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to each message you send. The matching public key sits in your DNS. A receiving server uses it to confirm two things: the message really came through your email provider, and nobody altered it on the way.

Your email provider generates the DKIM key for you, but usually does not publish it. In Google Workspace, for example, DKIM stays off until an administrator copies the record into DNS and clicks “Start authentication.” A lot of small offices never did that step.

DMARC: what to do when the checks fail

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It is one record that tells receiving servers what to do with mail that claims to be from you but fails the checks:

• p=none means deliver it anyway, but send me a report.
• p=quarantine means put it in spam.
• p=reject means refuse it.

Without DMARC, anyone can send mail that shows your address in the “From” line. Receivers have no instruction from you about what to do with it.

Since February 2024, Google has required all three records from anyone sending 5,000 or more messages a day to Gmail users, and Yahoo has set the same rule for bulk senders. Both also require every sender, of any size, to have at least SPF or DKIM in place. Most small businesses are nowhere near 5,000 a day, but the same checks feed into spam filtering for everyone.

How to check yours in five minutes

1. Send yourself a test. From your business address, send an email to a personal Gmail account. Open it, click the three dots beside the reply arrow, and choose Show original. Near the top, Gmail lists SPF, DKIM and DMARC, each marked PASS or FAIL.
2. Look up your DMARC record. Google’s free Dig tool works: choose TXT and search for the TXT record (a line of plain text stored in your DNS) at _dmarc.yourdomain.com. If nothing comes back, you have no DMARC record.
3. Count your SPF records. Look up the TXT records on yourdomain.com itself. More than one line beginning with v=spf1 means you need to merge them.

If all three say PASS and you have a single SPF record, you are in good shape. If not, the fix is usually a quarter of an hour in your DNS settings. Start DMARC at p=none, read the reports for a few weeks, then tighten it.

Where this fits

These records protect your domain: they stop strangers from sending mail that claims to be from you. They do nothing to protect your account. If someone has your password, their mail goes out through your real account and passes every check. That is a separate problem: here are six signs your business email account has been taken over.