SPF, DKIM and DMARC explained (without the jargon)
SPF, DKIM and DMARC are the three pillars of email authentication. Together they let a receiving server answer one question: 'Is this message really from who it claims to be?' Get them right and you protect both your deliverability and your brand from spoofing. Here's each one, without the jargon.
SPF: who's allowed to send
Sender Policy Framework is a DNS record listing the servers permitted to send email for your domain. When a message arrives, the receiver checks whether it came from an approved server. If not, SPF fails.
The main gotcha: SPF is limited to 10 DNS lookups. Too many 'include' statements (from various sending services) and SPF breaks with a permerror — which many receivers treat as a failure.
DKIM: proof the message wasn't tampered with
DomainKeys Identified Mail adds a cryptographic signature to every message, using a private key only you hold. The matching public key lives in your DNS. The receiver verifies the signature to confirm two things: the mail genuinely came from your domain, and it wasn't altered in transit.
DMARC: the policy that ties it together
SPF and DKIM each prove something, but on their own they don't tell a receiver what to do when a check fails. DMARC does. It's a DNS policy that says, in effect: 'If mail claiming to be from my domain fails authentication, here's how to handle it — and send me reports.'
- p=none — monitor only; collect reports, take no action
- p=quarantine — send failing mail to spam
- p=reject — block failing mail outright (strongest)
- rua — the address where aggregate reports are sent
How they work together
Think of it as a chain: SPF and DKIM each provide a verifiable signal, and DMARC checks that at least one of them passes and is aligned with the visible 'From' domain. Only then does the message earn full trust. Skip any link and spoofers can slip through.
Rolling out DMARC safely
Don't jump straight to p=reject — you risk blocking your own legitimate mail. Start at p=none with a reporting address, use the reports to find and authenticate every service that sends on your behalf, then tighten to quarantine and finally reject as your confidence grows.
Frequently asked questions
Do I need all three, or is one enough?
You need all three. SPF and DKIM each prove a different thing, and DMARC is what turns those proofs into an enforceable policy that stops spoofing. Modern mailbox providers increasingly expect the full set.
Will setting up DMARC block my legitimate email?
Not if you roll it out carefully. Start at p=none to monitor, use the reports to authenticate every legitimate sender, and only then move to quarantine and reject. Jumping straight to reject is what causes problems.
What's an SPF permerror?
It means your SPF record triggered more than the allowed 10 DNS lookups, so evaluation failed. Fix it by removing unused includes or flattening the record. A checker will show your current lookup count.
Start sending in minutes
Create a free account, connect your domain and reach your audience across every channel — no credit card needed.
Free plan forever · No credit card required · Set up in minutes