Free tools · Guide

SPF, DKIM and DMARC explained without jargon

Anyone can send an email that claims to come from billing@your-business.com. Without protection, your customers have no way to tell it's fake. SPF, DKIM and DMARC are three small records in your domain's DNS that fix this.

SPF: who may send on your behalf

SPF is a list of servers allowed to send email with your domain, for example Google Workspace or Microsoft 365. A server that isn't on the list is suspicious.

It's a TXT record that looks like v=spf1 include:_spf.google.com ~all. There can only be one: two SPF records cancel each other out.

DKIM: a signature on every email

DKIM signs every email with a secret key. The receiver checks the signature with the public key in your DNS. That way it knows the email really came from you and wasn't changed on the way. You turn it on in your email provider's dashboard, which gives you the record to copy.

DMARC: what to do with the fakes

DMARC tells servers what to do when an email fails SPF and DKIM: let it through (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also sends you reports about who is sending email in your name.

Where to start

1. Check your domain with the free tool.
2. Create SPF for the email service you use.
3. Turn on DKIM in your email provider's dashboard.
4. Create DMARC with p=none, wait 2 to 4 weeks, then move to p=quarantine.

Bonus: Google, Microsoft and Yahoo now require SPF, DKIM and DMARC from bulk senders. With all three, your real emails land in the inbox more often.