SPF, DKIM and DMARC: authenticate your email step by step

Updated 23 September 2026

Without these three DNS records, messages sent from your domain look suspicious to Gmail, Outlook or Yahoo, and anyone can impersonate you. Here is how to set them up without breaking anything.

What the three mechanisms do

Mechanism	What it proves	Where it lives
SPF	The sending server is allowed to send for this domain	TXT record at the root of the domain
DKIM	The message was not altered and really comes from the domain that signed it	TXT record `selector._domainkey.domain`
DMARC	What the recipient should do if SPF and DKIM fail, and where to send reports	TXT record `_dmarc.domain`

Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, and they apply them more and more strictly to everyone. A domain without authentication sees its deliverability drop.

Step 1: SPF

The SPF record lists the authorised servers. Example for a domain that sends through an email provider and a newsletter tool:

v=spf1 include:_spf.provider.com include:send.newsletter.com ~all

Rules to follow:

only one SPF record per domain: two v=spf1 records make SPF invalid. Merge the include entries.
ten DNS lookups at most: every include, a or mx counts. Beyond that, SPF fails.
**end with ~all** (soft fail) at first, then with -all once you are sure every sender is listed.
a domain that never sends email can publish v=spf1 -all: nobody will be able to spoof it.

Step 2: DKIM

DKIM signs each message with a private key; the public key is published in DNS. Your sending provider generates the key pair: it gives you the record name (for example s1._domainkey.example.com) and its value, or a CNAME to create.

turn on DKIM for every service that sends on your behalf: mailbox, newsletter, invoicing, shop;
prefer 2048-bit keys;
once the record is published, enable signing in the provider's dashboard, then send yourself a message and check for the DKIM-Signature header and a dkim=pass result.

Step 3: DMARC, in three stages

DMARC ties SPF and DKIM to the domain shown in the "From" field. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

**p=none** for two to four weeks: nothing is blocked, but you receive reports listing every server sending in your name. You will often discover a forgotten service.
**p=quarantine**: failing messages go to spam. You can ramp up gradually with pct=25, then 50, then 100.
**p=reject**: spoofed messages are refused. This is full protection.

The reports are hard-to-read XML files: a DMARC analysis tool, often free for small volumes, summarises them in a table.

Checking your setup

With our DNS lookup tool, query the TXT records of the domain, of _dmarc.domain and of selector._domainkey.domain. Then send a message to a Gmail or Outlook inbox and view the original: the Authentication-Results line should show spf=pass, dkim=pass and dmarc=pass.

The most common mistakes

Two SPF records after adding a new service.
More than ten DNS lookups in SPF from stacking include entries.
DKIM enabled for the mailbox but forgotten for the newsletter tool.
Jumping straight to p=reject without a monitoring period: legitimate messages get blocked.
A DMARC record created on the domain itself instead of _dmarc.domain.

Open the NetCheck tools

What "spf=pass" means, and what it doesn't

When you open the original of a message, the Authentication-Results header shows a line like this:

spf=pass (domain of bounce@example.com designates 203.0.113.10 as permitted sender) smtp.mailfrom=bounce@example.com

SPF pass means the IP address that delivered the message is listed in the SPF record of the domain in smtp.mailfrom, also called the envelope sender or Return-Path. It does not check the address shown in the From field. A scammer can get an SPF pass on their own domain while displaying your brand in From.

That is why DMARC exists: it only passes when SPF or DKIM passes and the domain is aligned with the From domain.

The SPF results you can see

Result	Meaning	What to do
`pass`	Sending IP is authorised	Nothing, check DMARC alignment
`fail`	IP not authorised, record ends in `-all`	Add the missing sender to SPF
`softfail`	IP not authorised, record ends in `~all`	Same, then consider `-all`
`neutral`	Record ends in `?all`, no verdict	Use `~all` or `-all` instead
`none`	No SPF record found	Publish one
`permerror`	Record broken: two records, syntax error, more than ten lookups	Fix the record
`temperror`	Temporary DNS problem	Usually resolves itself, recheck later

SPF pass but DMARC fail?

This usually happens when a newsletter or invoicing service sends with its own bounce domain. SPF passes for their domain, not yours, so it is not aligned. Enable DKIM signing with your domain in that service, or configure a custom return-path on a subdomain of yours.

Frequently asked questions

Is SPF enough without DKIM?

No. SPF breaks when mail is automatically forwarded, because the forwarding server is not on your list. DKIM survives forwarding. DMARC only needs one of the two aligned with your domain, but having both makes authentication reliable.

How long before changes take effect?

As long as it takes for the records' TTL to expire, usually from a few minutes to an hour. DMARC reports generally arrive once a day.

Do I need DMARC if my domain sends no email?

Yes: publish v=spf1 -all and v=DMARC1; p=reject. Scammers specifically target unprotected domains to send phishing in their name.

What does spf=pass mean?

It means the server that sent the message is authorised by the SPF record of the envelope sender domain. It says nothing about the From address unless DMARC alignment also passes.

Why is SPF pass but DMARC fail?

The domain that passed SPF is not the domain in the From field, typically a sending service's bounce domain. Sign with DKIM on your own domain or set a custom return-path to get alignment.

What is the difference between SPF softfail and fail?

Both mean the sending IP is not authorised. Softfail comes from ~all and asks receivers to accept but mark the message, fail comes from -all and asks them to reject it.