authentication
SPF, DKIM & DMARC Explained (with Free Checkers)
Before a mailbox provider even reads your email’s content, it checks whether you’re allowed to send as your domain and whether the message has been tampered with. Three DNS records answer those questions: SPF, DKIM, and DMARC.
Check your domain right now: the free SPF, DKIM & DMARC Checker tests all three (plus MX) and tells you exactly what’s wrong.
SPF — who’s allowed to send
SPF (Sender Policy Framework) is a TXT record listing the mail servers authorized to send on behalf of your domain.
v=spf1 include:_spf.google.com -allinclude:_spf.google.com— trust Google’s servers (swap for your provider).-all— hard fail: reject anything from a server not listed. Use~all(soft fail) while testing, then tighten to-all.
Common SPF mistakes: having more than one SPF record (only one is allowed — merge them), and exceeding 10 DNS lookups (each include counts), which causes SPF to fail entirely regardless of content.
DKIM — proving the message wasn’t altered
DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key; the matching public key sits in your DNS at a selector-specific address:
google._domainkey.yourdomain.com
selector1._domainkey.yourdomain.com (Microsoft 365)You don’t write this by hand — your email provider generates the key pair and gives you the exact DNS record. Your job is just to add it and verify it resolves.
DMARC — the enforcement layer
DMARC ties SPF and DKIM together and tells receivers what to do when a message fails both:
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.comp=none— monitor only, no enforcement. Good starting point.p=quarantine— failing mail goes to spam.p=reject— failing mail is rejected outright. Strongest, use once confident.rua=— where DMARC sends you aggregate reports (who’s sending as your domain, pass/fail rates).
The rollout path: start at p=none for a week or two to see what the reports show, fix anything legitimate that’s failing, then move to quarantine, then reject.
How they work together
| Step | What happens |
|---|---|
| 1 | Receiving server checks SPF: is this server allowed to send for this domain? |
| 2 | Receiving server checks DKIM: does the signature verify, proving the message wasn’t altered? |
| 3 | Receiving server checks DMARC: did SPF or DKIM pass? If not, apply the DMARC policy (none/quarantine/reject). |
All three working correctly is what lets a mailbox provider say “this is verified, legitimate mail from this domain” — which is a prerequisite for inbox placement, not a guarantee of it. See why emails go to spam for the other two factors (content and reputation).
Fix it now
Run your domain through the free checker — it flags exactly which record is missing, misconfigured, or too permissive, with a specific fix for each.
Land in the inbox — automatically
MailPilot warms up your mailboxes across a network of real inboxes, so your emails stop hitting spam. Free to start, no credit card.
Start free warmupSPF, DKIM & DMARC Explained (with Free Checkers) — FAQ
What's the difference between SPF, DKIM, and DMARC?
SPF is a list of servers allowed to send mail for your domain — it stops someone else's server from claiming to be you. DKIM is a cryptographic signature on each message — it stops the CONTENT from being altered in transit and proves it really came from your system. DMARC sits on top of both: it tells receivers what to do (nothing, quarantine, or reject) when SPF or DKIM fails, and gives you visibility via reports.
Do I need SPF, DKIM, and DMARC, or just one?
You need all three for real protection. SPF alone can be defeated by mail forwarding. DKIM alone doesn't specify what happens on failure. DMARC needs at least one of SPF or DKIM passing underneath it to have anything to enforce. Most major providers (Gmail, Yahoo) now require DMARC for bulk senders — so treat all three as mandatory, not optional.
How do I set up SPF, DKIM, and DMARC?
SPF and DMARC are TXT records you add in your domain's DNS. DKIM is enabled through your email provider (Google Workspace, Microsoft 365, or your ESP) which generates the key pair and gives you the DNS record to add — you don't write DKIM by hand. After adding all three, use a checker to confirm they resolve and pass.
What happens if I don't set these up?
Your mail can still send, but mailbox providers treat it as unverified — it's more likely to be filtered to spam or rejected outright, and anyone can spoof your domain to send phishing mail that looks like it's from you. Missing authentication is one of the most common hidden causes of good emails landing in spam.