SPF, DKIM and DMARC explained

The "From" field of an e-mail can say anything. The mail protocol dates from a time when nobody thought about forged senders, and it checks nothing on its own. That is why SPF, DKIM and DMARC exist: three records in the DNS of your domain that let receiving servers tell whether a mail really comes from you. Without them, your mail lands in spam – or someone else sends mail in your name.

SPF: who may send for your domain?

SPF (Sender Policy Framework) is a list of the servers allowed to send mail for your domain. It is a TXT record in your DNS, for example:

example.com.  TXT  "v=spf1 include:_spf.google.com include:mailgun.org ~all"

The receiving server looks at which server the mail came from and compares it with this list. include: pulls in the list of a provider, such as your mail host or newsletter tool. The end decides what happens to everyone else: ~all means "suspicious", -all means "reject".

Worth knowing:

• A domain has exactly one SPF record. Two records count as an error, even if each one is correct on its own.
• SPF does not check the visible "From", but the sender address on the envelope of the mail (the "Return-Path"). Mail programs usually hide it.
• At most ten DNS lookups: every include: counts, nested ones too. Add enough services and you hit this limit quickly.
• +all lets any server send anything and makes SPF worthless.

DKIM: a signature that travels with the mail

DKIM (DomainKeys Identified Mail) signs every outgoing mail digitally. The sending server builds a signature from parts of the header and the body and writes it into the DKIM-Signature header. You publish the matching public key in your DNS under a name of your choice (the "selector"):

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

The receiving server fetches the key and checks whether the signature matches. If it does, the mail was not changed on the way and comes from a server that holds the domain's private key.

One advantage over SPF: the signature travels with the mail. If someone forwards your message, it stays valid as long as the content is unchanged.

DMARC: the rule that ties it all together

SPF and DKIM have a gap: they check domains the recipient never sees. A scam mail can pass SPF for scammer.example and still display From: bank.example.

DMARC closes that gap. It requires at least one of the two checks to pass and to match the domain in the visible "From". That match is called alignment. DMARC also decides what happens to mail that fails:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

• p=none: monitor only, block nothing.
• p=quarantine: move suspicious mail to spam.
• p=reject: refuse suspicious mail.
• rua=: an address for daily reports on which servers send mail in your name.

Start with p=none and read the reports for a few weeks. That way you find services you forgot in SPF or DKIM before you switch to quarantine or reject.

Why it is mandatory now

Since February 2024, Gmail and Yahoo require senders of large volumes (at Gmail, more than 5,000 messages a day) to use SPF and DKIM, publish a DMARC record of at least p=none, offer one-click unsubscribe and keep spam complaints low. Microsoft introduced similar rules for Outlook.com in 2025.

Smaller senders benefit too: mail that passes SPF, DKIM and DMARC lands in spam far less often, and strangers can no longer easily abuse your domain for phishing.

How to check your mail

The simplest way is to send a real mail to a test address and look at what the receiving server recorded. It writes the result into the Authentication-Results header, for example:

Authentication-Results: mx.example.net;
  spf=pass smtp.mailfrom=bounce.example.com;
  dkim=pass header.d=example.com;
  dmarc=pass header.from=example.com

The TossPost mail tester does this for you: you get a test address, send your newsletter or sign-up mail to it and receive a report with a score from 0 to 10. It shows whether SPF, DKIM and DMARC pass, whether they match the sender domain and whether your domain's DNS records are complete.

Common mistakes

• A forgotten service: the newsletter tool or help desk sends mail but is missing from SPF and does not sign with DKIM.
• Two SPF records, because a new service asked for its own. Merge the include: entries into a single record.
• Too many DNS lookups in SPF from nested include: entries.
• DKIM set up, key not published: the provider signs, but the record under selector._domainkey is missing.
• DMARC switched to reject too early: legitimate mail is refused because one service does not align yet.

In short

SPF says which servers may send. DKIM signs every mail. DMARC requires both to match the visible sender and decides what happens otherwise. With all three in place, your mail arrives and your domain is protected from abuse.

Check whether your mail passes