SPF, DKIM and DMARC explained

Fake invoices and booking confirmations sent “from” your domain damage trust quickly. These three DNS-based standards are the defence.

Last reviewed: 2026-10-18

What each one does

  • SPF (RFC 7208) lists the servers allowed to send mail for your domain. Example: v=spf1 include:_spf.google.com ~all. Only one SPF record is allowed per domain, and it may trigger no more than 10 DNS lookups.
  • DKIM (RFC 6376) adds a cryptographic signature to each message. The public key is published at selector._domainkey.yourdomain.
  • DMARC (RFC 7489) tells receivers what to do when SPF or DKIM fail to align with the visible From domain, and sends you reports. Example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.

A safe rollout

  1. Inventory everything that sends email as you: Google Workspace or Microsoft 365, booking engines, newsletter tools, invoicing systems.
  2. Publish one SPF record that includes them all.
  3. Turn on DKIM in each sending platform.
  4. Publish DMARC at p=none with reporting, and review the reports for 2–4 weeks.
  5. Move to p=quarantine, then p=reject, once legitimate mail aligns.

Why it matters for deliverability

Google requires all senders to Gmail accounts to set up SPF or DKIM. Bulk senders must set up SPF, DKIM and DMARC (Google: Email sender guidelines).

Our free scan checks SPF and DMARC. The Full Scan Report also checks common DKIM selectors and gives you exact records to publish.

Sources

Find out what your website reveals

Run the free passive mini-scan in under a minute, or ask for a quote for the full report.

Run free mini-scanRequest a quote