SPF, DKIM, DMARC: How Email Authentication Works

SPF, DKIM, and DMARC at a Glance

Here’s the short version before we get into the detail:

• SPF says which servers are allowed to send email for your domain.
• DKIM adds a tamper-proof signature that proves the message wasn’t changed.
• DMARC tells receiving servers what to do when SPF or DKIM fails, and sends you reports.

You need all three. SPF and DKIM do the checking. DMARC ties them together and gives you a policy and visibility.

Record	What it does	What it checks	Where it lives
SPF	Lists authorized sending servers	The sending server’s IP address	DNS TXT record
DKIM	Adds a cryptographic signature	That the message wasn’t altered in transit	DNS TXT record
DMARC	Sets the policy for failures + reporting	The results of SPF and DKIM alignment	DNS TXT record

What Are SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are email security protocols. They verify that an email really came from the domain it claims to be sent from.

Spam is a huge problem for internet service providers (ISPs). It’s estimated that over half of all emails sent are spam. To cut down that volume, ISPs use SPF, DKIM, and DMARC to check that a message came from a legitimate domain and wasn’t changed on the way.

Each method works in a different way. But they all do the same job at heart. They set out rules for deciding whether an email is genuine. Your domain publishes these rules in its DNS records, and the receiving mail server reads them.

SPF and DKIM are the authentication checks. DMARC is the set of instructions that tells the receiving server what to do when SPF or DKIM fails.

How Does SPF Work?

Sender Policy Framework (SPF) records list all the IP addresses of the servers and apps that are allowed to send email for your domain.

When a mail server receives your email, it checks the SPF record to make sure the message came from one of those approved servers.

Think of SPF like the guest list for an exclusive club. Just as a bouncer won’t let in anyone who isn’t on the list, a mail server can reject email from a sending IP that isn’t in your SPF record. Some servers won’t block a failed message outright. They’ll mark it as spam instead.

An SPF record is a single line of text in your DNS. It looks like this:

v=spf1 include:_spf.sendlayer.net ~all

Even if you don’t send email from your domain, you should still set an SPF record. It stops bad actors from spoofing your domain and sending email that looks like it came from you.

You should only ever have one SPF record per domain. If you use two or more services that each give you an SPF record (say, your web host’s email plus a service like SendLayer), you need to merge them into one. This tutorial shows you how to merge SPF records.

How Does DKIM Work?

DomainKeys Identified Mail (DKIM) lets you attach a digital signature to your email to prove it came from your domain.

DKIM uses public key cryptography. It also confirms that the content of the email wasn’t tampered with between the sending server and the receiving one.

Your DKIM record stores your domain’s public key. Any mail server can request and read it.

When you send an email, your server signs the message header with a private key. That key stays secret, and only you have it.

The receiving server applies your public key to the incoming message. The email only passes if it was signed with the matching private key.

DKIM records use a “selector” so a domain can hold more than one key at a time. That’s why a DKIM record name looks like selector._domainkey.yourdomain.com. If DKIM fails, the email may be blocked or marked as spam.

How Does DMARC Work?

Domain-based Message Authentication, Reporting and Conformance (DMARC) is a policy. It tells receiving mail servers what to do with your email based on whether it passes or fails SPF and DKIM.

You set the DMARC policy for your domain, so you decide what happens to messages that fail authentication. DMARC also sends you reports about mail claiming to be from your domain, which is a useful early warning for spoofing and phishing.

Your DMARC policy is stored as a DNS TXT record, and the key part is the p= tag. It has three settings:

• p=none is monitor-only. Failed email still gets delivered, but you receive reports. Start here.
• p=quarantine sends failed email to the spam folder.
• p=reject blocks failed email completely. This is the strongest protection.

A basic DMARC record looks like this:

v=DMARC1; p=none; rua=mailto:[email protected]

Most people start at p=none to watch the reports, then move to quarantine and finally reject once they’re sure legitimate email is passing. Jumping straight to reject can block your own mail if a record is wrong, so it pays to ramp up.

Are SPF and DKIM Required for DMARC?

You don’t have to use both SPF and DKIM for DMARC, but it’s strongly recommended.

When you compare SPF and DKIM, neither one is better than the other. They just work differently. SPF confirms an email came from the domain it claims to. DKIM confirms the message wasn’t intercepted or altered on the way.

The best setup uses both protocols alongside DMARC for complete coverage.

Why SPF, DKIM, and DMARC Matter

Email authentication used to be a nice-to-have. Now it’s a requirement at the biggest mailbox providers.

In February 2024, Google and Yahoo began requiring bulk senders to authenticate their email. If you send more than 5,000 messages a day, you need all three: SPF, DKIM, and DMARC. Microsoft rolled out matching rules for Outlook.com and Hotmail in 2025.

The bulk-sender rules also ask you to:

• Keep your spam complaint rate under 0.3% (aim for below 0.1%).
• Add one-click unsubscribe to marketing email.
• Send from a domain that matches your authentication.

Even if you send far fewer than 5,000 emails a day, these providers still treat authenticated mail as more trustworthy. Setting up all three records is now the baseline for reaching the inbox, not an advanced tactic.

How to Set Up SPF, DKIM, and DMARC

You set up SPF, DKIM, and DMARC in the DNS settings for your domain.

Where you find those settings depends on how your site and domain are hosted:

• If you bought your domain separately from your website, look in your domain registrar’s control panel.
• If your web host registered the domain for you, check your web hosting control panel.
• If you use a CDN like Cloudflare or a managed DNS provider, you’ll change the settings there.

If you’re not sure where your DNS settings live, contact your hosting provider.

SPF, DKIM, and DMARC are DNS records you add to your existing settings. You usually create and add them yourself. Most providers don’t generate them for you, so you’ll configure them by hand.

A good order to follow is SPF first, then DKIM, then DMARC. Set DMARC to p=none at the start so you can read the reports before you enforce a stricter policy.

Building these records by hand can be slow and confusing. You can ask your host for help, or use a service that generates them for you.

Using SendLayer to Authenticate Your Domain

SendLayer is a fast, reliable email delivery platform that authenticates your domain so your emails reach the inbox instead of the spam folder.

When you sign up for a SendLayer account, it automatically generates your SPF, DKIM, and DMARC records. You then copy and paste them into your DNS settings to add them to your domain.

Alongside SPF, DKIM, and DMARC, SendLayer also creates extra DNS records to verify you own the sending domain and to define a subdomain for your outgoing emails, which further improves deliverability.

For more on using SendLayer for authentication, follow our getting started guide. SendLayer also has a dedicated support team who’ll help you set up your DNS records if you hit a snag.

Once your domain is authenticated with SendLayer, the email you send carries that information in the header and gets accepted by incoming mail servers that require authentication, like Gmail.

How to Check and Test Your SPF, DKIM, and DMARC Records

There are two ways to confirm your records are working: check a message you’ve sent, or look up the records directly.

Check the email header

The easiest quick test is to send yourself a test email.

The SPF, DKIM, and DMARC results are added to the email header. Most email clients hide the header by default, but there’s usually a “Show original” or “Show details” link that reveals it.

Headers are long and built for machines, so the results can be tricky to spot. Look for a line that includes “spf”, “dkim”, or “dmarc”. If an email to a Gmail address passed SPF, you’ll see something like this:

spf=pass (google.com: domain of [email protected] designates example IP address as permitted sender)

Some clients, including Gmail, pull the authentication results out and show them in a friendlier format next to the Subject, From, and To fields when you view the original message.

In most cases, the email that reaches your inbox has passed authentication, since messages that fail are usually rejected or marked as spam.

Look up your records with a DNS tool

To check the records themselves rather than a single message, use a free DNS lookup tool. Tools like MXToolBox and dmarcian let you enter your domain and see whether your SPF, DKIM, and DMARC records exist and are formatted correctly. This is the fastest way to catch a typo or a missing record before it causes a delivery problem.

Monitor from WordPress

If you send email from WordPress, some SMTP plugins like WP Mail SMTP monitor your domain’s authentication status for you.

WP Mail SMTP makes it easy to use a delivery service like SendLayer to improve your WordPress email. Its built-in domain check shows at a glance whether your domain is failing any authentication check. You can install it when you set up your WordPress site to keep an eye on your email.

Common SPF, DKIM, and DMARC Mistakes to Avoid

A few small errors trip people up more than any others:

• More than one SPF record. A domain can only have one. Two SPF records will fail. Merge them into a single line.
• Leaving DMARC on p=none forever. Monitoring is a starting point, not the finish line. Move to quarantine or reject once your legitimate mail is passing.
• No DMARC at all as a bulk sender. If you send 5,000+ emails a day to Gmail or Yahoo, a missing DMARC record can get your mail rejected.
• The wrong DKIM selector. The record name has to match the selector your sending service uses, or the lookup fails.
• Forgetting a sending service. Every tool that sends on your behalf (your CRM, your newsletter tool, your host) needs to be covered by your SPF and DKIM setup.

Improve Email Deliverability With SPF, DKIM, and DMARC

Many factors affect your email deliverability, but authentication is one of the most important.

Google now blocks email sent to Gmail users that isn’t authenticated with SPF or DKIM, and Yahoo enforces the same requirement. Microsoft joined them in 2025. Authentication isn’t optional anymore.

Our research shows that many organizations still don’t have DMARC set up. Completing the full trio of SPF, DKIM, and DMARC is the best way to make sure your email reaches the inbox.

You can also add BIMI authentication to show your brand logo in the inbox of supporting email clients. Used with SPF, DKIM, and DMARC, it adds another layer of security and boosts your brand’s reputation.

Frequently Asked Questions About SPF, DKIM, and DMARC