SPF, DKIM and DMARC Explained: Email Authentication for Better Deliverability

If your business email keeps landing in spam - or worse, someone is sending fake emails using your domain - the fix usually comes down to three DNS records: SPF, DKIM and DMARC. Together they prove your mail is genuine. Here is what each one does, in plain English.

Why email authentication matters

Email was designed in a more trusting era, so by default anyone can claim to send "from" your domain. Authentication records close that gap. They tell receiving servers (Gmail, Outlook, etc.) that a message really came from you - which:

Improves deliverability so your mail reaches the inbox
Stops spoofing so scammers cannot impersonate your brand
Protects your reputation as a sender

SPF: who is allowed to send

SPF (Sender Policy Framework) is a DNS record listing the servers permitted to send mail for your domain. When a message arrives, the receiver checks whether it came from an approved source. If not, it is treated as suspicious.

Think of SPF as a guest list for your domain's outgoing mail.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds an encrypted signature to every message. The receiving server uses a public key in your DNS to verify the signature. If it matches, the message is genuine and was not altered in transit.

Think of DKIM as a wax seal that proves the letter is really from you and unopened.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when SPF or DKIM fail - monitor, quarantine (send to spam) or reject outright. It also sends you reports so you can see who is sending mail as your domain.

Think of DMARC as the rulebook plus the security camera.

How to set them up

Add the SPF TXT record your email provider gives you.
Enable DKIM in your provider and publish the public key in DNS.
Add a DMARC record, starting with a monitoring policy (p=none), then tighten to quarantine and finally reject once you confirm everything passes.

This is part of the standard setup we cover in How to set up business email with a custom domain.

A common gotcha

Roll out DMARC gradually. Jumping straight to p=reject before SPF and DKIM are fully aligned can block your own legitimate mail. Start with monitoring, read the reports, then enforce.

Let your provider handle it

A good business email host generates these records for you and guides you through publishing them - so authentication is set up correctly from day one.

Want your domain configured for perfect deliverability? Talk to us and we will handle SPF, DKIM and DMARC for you.