Swipe the diagram to see the rest
Why they exist
Email was designed without authentication: any server can put any address in the From line. SPF, DKIM and DMARC are the three DNS-based standards that let a receiving server check a message really came from the domain it claims. Since 2024, Gmail and Yahoo require all three for anyone sending in bulk, and they strongly favour mail that has them at any volume.
SPF - which servers may send
SPF (Sender Policy Framework) is a TXT record listing the IP addresses and services allowed to send mail for a domain. The receiving server looks up the SPF record of the envelope sender (the Return-Path, not the visible From) and checks the connecting IP against it.
sp.yourdomain.com. TXT "v=spf1 include:spf.sendpository.com -all"
- A domain may have only one SPF record. Two records invalidate both - the most common SPF mistake.
- -all (hard fail) says anything not listed is unauthorised; ~all (soft fail) says it's suspicious. Use -all once you're sure the list is complete.
- SPF allows at most 10 DNS lookups. Every include counts, so long chains of includes break silently.
DKIM - a signature on every message
DKIM (DomainKeys Identified Mail) signs selected headers and the body with a private key. The public key is published in DNS under a selector, and the receiver uses it to verify the signature. A valid DKIM signature proves the message wasn't modified in transit and that it was authorised by the domain in the signature's d= tag.
s1a2b3._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
- Use 2048-bit keys. 1024-bit keys are still accepted but are the weakest size in common use.
- Each sending service gets its own selector, so several can sign for one domain without conflict.
- DKIM survives forwarding better than SPF, which is why DMARC is usually satisfied by DKIM.
DMARC - the policy that ties them together
DMARC checks alignment: the domain SPF or DKIM authenticated must match the domain in the visible From address. If neither aligns, the receiver applies your published policy - none (just report), quarantine (spam folder) or reject.
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
- Start with p=none and a rua address to receive aggregate reports; move to quarantine and then reject once reports show only your own services.
- Relaxed alignment (the default) accepts subdomains; strict (adkim=s, aspf=s) requires an exact match.
- DMARC passes if either SPF or DKIM passes and aligns - not both.
How they fit together
| Check | Looks at | Proves | Survives forwarding |
|---|---|---|---|
| SPF | Envelope sender (Return-Path) | The sending server is allowed | No |
| DKIM | d= in the signature | The message is unaltered and authorised | Usually |
| DMARC | Visible From domain | SPF or DKIM passed for that domain | Via DKIM |
Three addresses in one email
Most confusion about these records comes from one fact: an email carries several different domains, and each check looks at a different one. The envelope sender (MAIL FROM, also called Return-Path) is where bounces go and is what SPF checks. The DKIM signature names a domain in its d= tag. The From header is what the recipient sees - and it is the only one DMARC cares about, by asking whether SPF or DKIM passed for a domain that matches it.
Return-Path: <bounces+a1b2@sp.acme.com> <- SPF checks sp.acme.com
DKIM-Signature: v=1; a=rsa-sha256; d=acme.com; <- DKIM verifies acme.com
s=s1abc; h=from:to:subject:date; ...
From: Acme <hello@acme.com> <- DMARC aligns to acme.com
Authentication-Results: mx.google.com;
dkim=pass header.d=acme.com;
spf=pass smtp.mailfrom=sp.acme.com;
dmarc=pass (p=NONE) header.from=acme.comHere SPF passes for sp.acme.com, which aligns with acme.com under DMARC's default relaxed mode, and DKIM passes for acme.com exactly. Either would be enough for DMARC; having both is what keeps mail delivered when one breaks - SPF, for example, fails whenever a message is forwarded.
Check your own domain
You can see every record from a terminal. dig asks DNS directly, so it shows what receivers see, not what your DNS panel says it saved.
# SPF: one TXT record starting v=spf1 dig +short TXT sp.acme.com # DKIM: the selector comes from the s= tag of a signed message dig +short TXT s1abc._domainkey.acme.com # DMARC dig +short TXT _dmarc.acme.com
Then send yourself a message and open it in Gmail with Show original: the summary at the top lists SPF, DKIM and DMARC as PASS or FAIL, and the Authentication-Results header says which domain each one checked. Or run the domain through the email DNS checker.
Setting them up with an email API
A good email provider generates the records for you. Sendpository creates a 2048-bit DKIM key per domain signed as your own domain (so it aligns even under strict DMARC), and puts SPF and the bounce record on a dedicated sp. subdomain so your existing Google Workspace or Microsoft 365 SPF record is never touched. It then re-checks the records daily.