What are SPF, DKIM and DMARC?
Three DNS records that together prove a domain's mail is genuine, not spoofed.
SPF, DKIM and DMARC — SPF, DKIM and DMARC are three DNS-based email authentication standards: SPF lists which servers may send for a domain, DKIM signs messages so they cannot be altered, and DMARC tells receivers what to do when the first two fail. Together they are the minimum for a domain to be trusted.
Why it matters
Email as a protocol has no built-in way to prove a message actually came from who it claims to. Anyone can put any "From" address on a message. SPF, DKIM and DMARC are three separate DNS records that close that gap together. SPF lists which mail servers are allowed to send on behalf of a domain, so a receiving server can check whether the sending server is on the approved list. DKIM adds a cryptographic signature to each message, so any tampering in transit is detectable. DMARC ties the two together, telling a receiving server what to do, quarantine, reject or allow, when a message fails SPF or DKIM.
Without all three set up correctly, a domain's mail is easier to spoof and gets less trust from receiving servers, which directly hurts deliverability. DMARC in particular is often set up wrong: the policy field can be set to `p=none`, meaning failures are only reported, not acted on. That is a reasonable starting point to see what fails without breaking anything, but a domain left there indefinitely is not actually enforcing anything, and a spoofed message using that domain still gets through to the recipient's inbox exactly as before.
How the three records work together
- 1
SPF is published
Listing which mail servers are authorized to send for the domain.
- 2
DKIM signing is enabled
Every outgoing message gets a cryptographic signature tied to the domain.
- 3
DMARC is published
Starting at p=none to monitor, referencing the SPF and DKIM results.
- 4
Reports are reviewed
DMARC aggregate reports show what is passing and what isn't.
- 5
The policy is tightened
Moved to p=quarantine, then p=reject, once legitimate mail reliably passes.
The mistake to watch for
Questions
- How is SPF, DKIM and DMARC different from BIMI?
- SPF, DKIM and DMARC authenticate that a message genuinely came from the claimed domain. BIMI is a separate, later standard that displays a verified brand logo in the inbox, and it requires a strong DMARC policy already in place before it can be used.
- Do all three records need to be set up, or just one?
- All three work together. SPF and DKIM each authenticate the message in a different way, and DMARC is what tells a receiving server what to actually do when either check fails.
- What happens without these records?
- Mail from the domain is easier to spoof and receives less trust from mailbox providers, which lowers deliverability even for legitimate messages.