Last Updated on 4 months ago by Oğuz Yeşil
DKIM SPF DMARC explained, you have set up your email, written the perfect message, and hit send — only for it to land in the recipient’s spam folder. The culprit is almost always one of three email authentication protocols: SPF, DKIM, or DMARC. Here is a plain-English explanation of what each one does, why it matters, and how to check whether yours are configured correctly.
Why Email Authentication Matters
Every day, billions of spam and phishing emails are sent by attackers who forge the sender address to make messages look legitimate. Email authentication protocols exist to prove that an email genuinely came from who it claims to be from.
Without proper authentication, even legitimate emails from your domain can be flagged as suspicious by receiving mail servers — meaning your newsletters, transactional emails, and business correspondence never reach the inbox.
Getting SPF, DKIM, and DMARC right is not optional if you care about email deliverability. It is the foundation.
What Is SPF?
SPF — Sender Policy Framework
SPF is the simplest of the three. It tells receiving mail servers which IP addresses are authorised to send emails on behalf of your domain.
When someone receives an email from your domain, their mail server checks your DNS records for an SPF record. If the sending server’s IP address is listed there, the email passes. If not, it fails.
What an SPF record looks like
v=spf1 include:_spf.google.com ~allThis example tells receiving servers that Google’s mail servers are authorised to send on behalf of this domain. The ~all at the end means emails from unlisted servers should be treated with suspicion but not outright rejected.
Common SPF mistakes
- Having more than one SPF record on your domain — only one is allowed
- Exceeding ten DNS lookups, which causes SPF to fail silently
- Forgetting to include third-party senders like Mailchimp or SendGrid
What Is DKIM?
DKIM — DomainKeys Identified Mail
Where SPF verifies where an email came from, DKIM verifies that the email has not been tampered with in transit. It works by attaching a digital signature to every outgoing email.
When you set up DKIM, your mail server generates a pair of cryptographic keys — a private key that signs outgoing emails, and a public key that you publish in your DNS records. When a receiving server gets your email, it retrieves your public key and uses it to verify the signature. If it matches, the email is authentic.
Why DKIM matters
DKIM protects against email spoofing and man-in-the-middle attacks. It also improves your sender reputation, because mail providers like Gmail and Outlook use DKIM as a trust signal when deciding whether to deliver your email to the inbox or the spam folder.
What a DKIM record looks like
DKIM records are published as TXT records in your DNS under a selector subdomain, typically something like:
selector._domainkey.yourdomain.comThe value contains your public key and looks like a long string of characters. Your email provider will generate this for you — you simply need to add it to your DNS.
What Is DMARC?
DMARC — Domain-based Message Authentication, Reporting and Conformance
DMARC builds on top of SPF and DKIM. It tells receiving mail servers what to do when an email fails SPF or DKIM checks — and it sends you reports so you can see what is happening with your domain’s email traffic.
A DMARC policy has three possible actions:
| Policy | What it does |
|---|---|
| none | Monitor only — take no action, just send reports |
| quarantine | Send failing emails to the spam folder |
| reject | Block failing emails entirely |
What a DMARC record looks like
v=DMARC1; p=quarantine; rua=mailto:[email protected]
This tells receiving servers to quarantine emails that fail authentication and to send aggregate reports to the specified address.
Why DMARC matters
Without DMARC, anyone can send emails pretending to be from your domain. DMARC closes that gap. It also gives you visibility — the reports show you exactly which servers are sending email on your behalf, making it easy to spot whether someone is impersonating your brand.
SPF vs DKIM vs DMARC — What Is the Difference?
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it verifies | Sending server IP | Email content integrity | Policy enforcement |
| Where it lives | DNS TXT record | DNS TXT record | DNS TXT record |
| Protects against | IP spoofing | Email tampering | Domain impersonation |
| Works without the others | Yes | Yes | No — requires SPF or DKIM |
| Sends reports | No | No | Yes |
All three work together. SPF and DKIM do the authentication work; DMARC enforces the rules and reports on the results.
How to Check If Your SPF, DKIM, and DMARC Are Set Up Correctly
The fastest way is to test your SMTP server directly. A good SMTP tester will check your SPF record, verify your DKIM signature, inspect your DMARC policy, check whether your sending IP is on any blacklists, and give you an overall spam score.
You can do all of this for free using Nesdzo’s SMTP Tester — paste in your SMTP details and get a full report in seconds, with no sign-up required.
💡 Tip: Run the test after any DNS change. DNS propagation can take up to 48 hours, so it is worth verifying that your records are live and correct before sending a campaign.
Step-by-Step: Setting Up All Three
Step 1 — Set up SPF Log in to your DNS provider and add a TXT record to your root domain. The value will look like v=spf1 include:your-email-provider.com ~all. Your email provider’s documentation will give you the exact string to use.
Step 2 — Set up DKIM In your email provider’s settings, find the DKIM section and generate a key pair. Copy the public key value they provide and add it as a TXT record in your DNS under the selector subdomain they specify.
Step 3 — Set up DMARC Add a TXT record to _dmarc.yourdomain.com. Start with p=none to monitor without affecting delivery, then move to p=quarantine or p=reject once you are confident everything is working correctly.
Step 4 — Test everything Use an SMTP tester to verify all three records are in place and passing. Check your spam score and confirm your IP is not on any blacklists.
Frequently Asked Questions
Do I need all three — SPF, DKIM, and DMARC? Yes, ideally. SPF and DKIM each provide partial protection. DMARC ties them together and gives you enforcement and reporting. All three working together is the industry standard for email deliverability and security.
Will setting up DKIM and SPF stop my emails going to spam? It significantly improves your chances. Authentication is one of the most important factors in spam filtering. That said, content quality, sender reputation, and list hygiene also matter.
What happens if DMARC is set to reject? Emails that fail SPF and DKIM checks will be blocked entirely and never delivered. This is the most secure setting, but you should only use it after confirming all your legitimate sending sources are authenticated correctly.
How long do DNS changes take to apply? DNS propagation typically takes between a few minutes and 48 hours, depending on your provider and the TTL settings on your records.
How do I know if my IP is on a blacklist? Use an SMTP tester that includes a blacklist check. Nesdzo’s SMTP Tester scans your sending IP against major blacklists and reports the results instantly.