Quick Takeaway
SPF lists the servers allowed to send email for your domain, DKIM signs each email so receivers can tell it wasn’t altered, and DMARC tells receivers what to do when a message fails those checks. Gmail and Yahoo require bulk senders to have all three, so missing records can send your email to spam.
Key takeaways
- SPF = who may send, DKIM = proof the message wasn’t changed, DMARC = what to do with failures.
- Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, plus easy unsubscribe.
- Publish DMARC with p=none first, read the reports, then move to quarantine and reject.
- SPF has a 10-DNS-lookup limit: too many “include:” entries break it.
- You can check any domain’s records in seconds with a free tool.
If your invoices, quotes or newsletters land in spam, the cause is often not the content but three small DNS records. Big mailbox providers now check them on every message, and they have tightened the rules for senders.
This guide explains each record in plain words, shows examples and gives you a safe order to set them up. To see what any domain has published right now, run it through our free email verifier: the Domain tab shows SPF, DKIM, DMARC and DNSSEC.
- Email authentication
- Email authentication is a set of DNS records (SPF, DKIM and DMARC) that let receiving mail servers confirm a message really came from the domain it claims to be from.
SPF, DKIM and DMARC in One Table
| Record | Question it answers | Where it lives |
|---|---|---|
| SPF | Is this server allowed to send for this domain? | TXT record on your domain |
| DKIM | Was this message signed by the domain and left unchanged? | TXT record at selector._domainkey.yourdomain |
| DMARC | What should happen if SPF and DKIM fail, and who gets reports? | TXT record at _dmarc.yourdomain |
Why It Matters Now: Gmail, Yahoo and Microsoft Rules
Since February 2024, Google and Yahoo have required every sender to authenticate with SPF or DKIM. Bulk senders (Google defines these as sending more than 5,000 messages a day to Gmail addresses) must have SPF, DKIM and DMARC, keep spam complaints low (Google names a 0.3% ceiling) and offer one-click unsubscribe in marketing email. Microsoft has announced similar requirements for high-volume senders to Outlook.com addresses.
Small senders benefit too
Even if you send a few emails a day, authenticated mail is more trusted, and DMARC stops scammers from sending email that pretends to be from your domain.
SPF: Who Can Send for Your Domain
SPF is one TXT record listing the services that send your email, for example your mailbox provider and your newsletter tool.
v=spf1 include:_spf.google.com include:sendgrid.net -all- Publish only one SPF record per domain; combine services into it.
- SPF allows at most 10 DNS lookups. Each “include:” counts, and nested includes count too.
- End with -all (reject others) or ~all (soft fail) once you’re sure every sender is listed.
DKIM: A Signature on Every Email
DKIM adds a cryptographic signature to each message. Your email provider generates a key pair and gives you a TXT record to publish under a “selector”, such as google._domainkey. Turn DKIM on in every service that sends as your domain: your mailbox, your CRM, your newsletter tool.
google._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."Because selector names differ between providers, outside tools can only check common selectors. If a checker says DKIM is “unknown”, confirm it in your provider’s admin panel.
DMARC: The Policy and the Reports
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com| Policy | What receivers do with failing mail | When to use |
|---|---|---|
| p=none | Deliver as normal, send you reports | First 2–4 weeks: find every legitimate sender |
| p=quarantine | Send to spam | Once reports show your real mail passes |
| p=reject | Refuse the message | Full protection against spoofing |
A Safe Setup Order
Step 1: List everything that sends as your domain
Mailbox provider, website contact form, CRM, invoicing tool, newsletter and support desk.
Step 2: Publish one SPF record
Include each sender’s SPF entry and check you stay under 10 lookups.
Step 3: Turn on DKIM everywhere
Publish each provider’s DKIM record and enable signing in its settings.
Step 4: Publish DMARC at p=none
Add a reporting address and wait two to four weeks.
Step 5: Read the reports and fix gaps
Any legitimate service failing SPF or DKIM needs to be configured.
Step 6: Tighten to quarantine, then reject
Move one step at a time and keep watching the reports.
Common Problems and Fixes
| Problem | Likely cause | Fix |
|---|---|---|
| SPF “permerror” | Two SPF records, or more than 10 DNS lookups | Merge into one record; remove unused includes |
| Newsletter mail fails DMARC | The newsletter tool isn’t signing with your domain | Set up its DKIM (custom sending domain) in its settings |
| Contact-form email goes to spam | The website sends “from” your domain without authentication | Send through an authenticated SMTP service, or use a different “from” address |
| DKIM shows “unknown” in checkers | Your provider uses a selector the checker didn’t try | Confirm in your provider’s admin panel |
| Reports show unknown senders | Someone is spoofing your domain, or a forgotten tool | Identify it; add it to SPF/DKIM if yours, otherwise tighten DMARC |
| Mail rejected after p=reject | A legitimate sender wasn’t authenticated yet | Step back to quarantine, fix the sender, then return to reject |
Most small businesses need only a few senders: their mailbox provider, one newsletter or CRM tool and perhaps an invoicing app. List them first and the rest is a short checklist.
Check Your Domain for Free
Enter any address at your domain into our free email verifier and open the Domain tab to see your SPF, DMARC policy, DKIM on common selectors and DNSSEC. Before sending a campaign, also clean the list itself: our guide on how to verify an email address explains why. If your follow-ups run through a CRM, our CRM automation playbook shows how to keep lists clean automatically.
What is the difference between SPF, DKIM and DMARC?
SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receivers what to do when those checks fail and sends you reports.
Do I need DMARC if I’m a small business?
Yes, it’s recommended. It protects your domain from spoofing and helps your email get delivered. Start with p=none; it doesn’t block anything.
Why is my email going to spam even with SPF?
SPF alone isn’t enough. Add DKIM and DMARC, make sure every sending service is configured, and check your content and complaint rate.
Can I have two SPF records?
No. Multiple SPF records cause SPF to fail. Combine all senders into one record.
How do I check my SPF, DKIM and DMARC?
Use our free email verifier: enter any address at your domain and open the Domain tab.