Email DNS: SPF, DKIM and DMARC without the headache

If your mail lands in spam, email authentication is the first thing to check. Three DNS records do the work.

SPF — who may send as your domain

example.com.    TXT    "v=spf1 include:mail.yourprovider.example -all"

• v=spf1 — the version.

• include: — authorises a provider's servers to send for you.

• -all — fail anything not listed (strict). ~all is a softer "softfail" during rollout.

One SPF record only. A domain with two v=spf1 TXT records breaks SPF entirely. Merge them into one.

DKIM — a cryptographic signature

Your mail server signs outgoing mail; the public key lives in DNS:

selector._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

The receiver checks the signature against the published key. Tampering breaks it. The selector is chosen by your mail system — your provider tells you which one to publish.

DMARC — what to do when SPF/DKIM fail

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:[email protected]"

• p=none — monitor only; deliver regardless. Start here.

• p=quarantine — send failures to spam.

• p=reject — reject failures outright. The goal.

• rua= — where to send aggregate reports, which show who is sending as you and whether they pass.

Rollout order that does not break your mail

1. Publish SPF with ~all.

2. Publish DKIM for every sender (including any marketing platform).

3. Publish DMARC as p=none with a rua address.

4. Read the reports for a few weeks — find legacy senders you forgot.

5. Tighten SPF to -all, then move DMARC to quarantine, then reject.

Doing steps 4 and 5 without step 3's monitoring is how organisations lose legitimate mail.

Also important

• MX — where mail is delivered (separate from authentication). See Email hosting setup.

• PTR / reverse DNS — must match the sending hostname, or many receivers distrust you regardless of SPF/DKIM.

• Consistency — send from a domain you control, with a matching envelope-from, and keep your From domain stable.

Verify

Use our SPF/DMARC checker or:

dig example.com TXT +short
dig _dmarc.example.com TXT +short
dig selector._domainkey.example.com TXT +short

Related reading

• Email deliverability troubleshooting

• Email hosting setup