SPF, DKIM and DMARC explained – with examples and common mistakes
SPF, DKIM and DMARC are three DNS records that let mailbox providers recognize whether an email really comes from you. If they're missing or wrong, your emails land in spam – or fraudsters can send in your name. Here's how they work, what they look like and the most common mistakes.
The idea in one picture
Imagine a letter. SPF is the list of post offices allowed to hand in letters with your return address. DKIM is a seal on the envelope proving that the content wasn't changed on the way. DMARC tells the recipient what to do if the return address and seal don't match – and, if you like, sends you a report about it.
SPF: who may send for your domain?
SPF (Sender Policy Framework) is a TXT record directly on your domain. It lists all servers and services that may send email for this domain:
example.com. TXT "v=spf1 ip4:203.0.113.10 include:_spf.newsletter-tool.example ~all"
ip4:andip6:allow individual addresses or networks.include:adopts the list of a service, such as your newsletter tool.~allmeans: everyone else is suspicious.-allmeans: everyone else is not allowed.
By the way, SPF doesn't check the visible sender address but the technical return address (Return-Path). Why that matters is explained under alignment.
DKIM: the digital signature
With DKIM (DomainKeys Identified Mail), the sending server signs every email with a secret key. You publish the matching public key in DNS, under a name called the selector:
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"
The receiving mailbox reads the selector from the email, fetches the key from DNS and verifies the signature. If the email was changed on the way, the check fails. Every service that sends for you needs its own signature – usually the service gives you a ready-made record, often as a CNAME.
Use keys with 2048 bits. 1024 bits are considered too weak and are increasingly downgraded.
DMARC: the rules of the game
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc. It ties SPF and DKIM to the visible sender address and defines what happens to emails that fail:
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"
| Part | Meaning |
|---|---|
p=none | Monitor only, reject nothing. Good for getting started. |
p=quarantine | Emails that fail go to spam. |
p=reject | Emails that fail are rejected. The best protection against forgery. |
rua= | Address for daily aggregate reports: who sends in your name and whether it passes. |
pct= | Share of emails the policy applies to (default 100). |
Alignment: where it fails most often
An email only passes DMARC if SPF or DKIM passes and the checked domain matches the visible sender address. That's exactly what's often missing:
- Your newsletter tool sends with the return address
bounce@mail.newsletter-tool.example. SPF passes – but for the tool's domain, not yours. That doesn't count for DMARC. - The tool signs with DKIM, but with
d=newsletter-tool.example. That doesn't matchFrom: news@example.comeither.
The solution is almost always to “authenticate” your own domain in the tool: you add the DKIM records shown (and often a custom return-path domain) to your DNS. After that the tool signs with d=example.com, and DMARC passes.
Introducing DMARC in three stages
- Monitor: create
p=nonewithrua=and collect reports for two to four weeks. This shows you every service that sends in your name – including forgotten ones like your invoicing software or contact form. - Secure: once all legitimate senders pass SPF or DKIM with an aligned domain, switch to
p=quarantine. - Complete: after further weeks without problems, move to
p=reject. From now on nobody can credibly send in your name.
The most common mistakes
| Mistake | Consequence | Solution |
|---|---|---|
| Two SPF records on the same domain | SPF is invalid (permerror) | Merge everything into one record |
| More than 10 DNS lookups in SPF | SPF is invalid (permerror) | Remove unnecessary include:, use ip4: where possible |
+all in SPF | Anyone may send in your name | Use ~all or -all |
| Forgotten service (CRM, shop, ticket system) | Its emails fail | Analyze DMARC reports, add the service to SPF or DKIM |
| DKIM key with 1024 bits | Weaker rating | Generate a new 2048-bit key |
DMARC permanently at p=none | No protection against forgery | Go through the stages above |
| No alignment with the newsletter tool | DMARC fails although SPF and DKIM “pass” | Authenticate your own domain in the tool |
Want to know how things look for you? The test on the home page checks all three records on a real email and suggests the matching DNS records right away.