Understanding SPF, DKIM, and DMARC
A plain-english guide to securing your email domains and ensuring your emails reach the inbox instead of the spam folder.
If your emails are constantly landing in spam, or if you’re worried about hackers spoofing your domain to send phishing emails, you need to configure three crucial DNS records: SPF, DKIM, and DMARC.
These acronyms sound intimidating, but they form a cohesive, three-layered security blanket for your domain’s email.
1. SPF (Sender Policy Framework)
SPF is essentially a guest list for your domain. It is a TXT record added to your DNS that explicitly lists the IP addresses and third-party services (like Google Workspace, Mailchimp, or SendGrid) that are authorized to send email on your behalf.
When an email arrives at a receiving server (like Gmail), the server checks the SPF record. If the sender’s IP isn’t on the guest list, the email is flagged as suspicious.
2. DKIM (DomainKeys Identified Mail)
While SPF checks where the email came from, DKIM checks if it was tampered with in transit. DKIM adds a cryptographic signature to your emails.
You place a public key in your DNS records, and your email provider signs every outgoing email with a private key. The receiving server uses the public key to verify the signature. If the signature matches, the server knows the email genuinely originated from you and hasn’t been altered by a man-in-the-middle attack.
3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)
SPF and DKIM are great, but what happens if an email fails those checks? That’s where DMARC comes in. DMARC is the boss that tells receiving servers exactly what to do with emails that fail SPF or DKIM.
You can set DMARC policies to:
p=none(Just monitor failures, but deliver anyway)p=quarantine(Send failing emails to the spam folder)p=reject(Outright delete failing emails before they even reach the user)
DMARC also generates daily reports detailing exactly who is sending email on your behalf, helping you identify unauthorized senders or misconfigured services.