SPF, DKIM & DMARC Explained (Plain English)
SPF, DKIM, and DMARC are three DNS records that work together to prove your emails are really from you. SPF lists who is allowed to send for your domain, DKIM adds a tamper-proof signature, and DMARC tells inbox providers what to do when a message fails—and sends you reports so you can see who is impersonating you.
The one-sentence version of each
Think of sending an email like mailing a letter. SPF is the approved list of post offices allowed to stamp your return address. DKIM is a wax seal that proves the letter was not opened and reads exactly as you wrote it. DMARC is the instruction to the recipient: if the return address does not match the seal, here is what to do with it—and please mail me a report.
The three records side by side
| Record | What it does | Where it lives | Example value |
|---|---|---|---|
| SPF | Lists the servers and services allowed to send email for your domain | Root domain TXT record | v=spf1 include:_spf.google.com ~all |
| DKIM | Adds a cryptographic signature so receivers can confirm the message was not altered | TXT record at a selector, e.g. s1._domainkey | v=DKIM1; k=rsa; p=MIGfMA0GCSq... |
| DMARC | Tells receivers what to do on failure and requests reports | TXT record at _dmarc | v=DMARC1; p=quarantine; rua=mailto:[email protected] |
SPF in plain English
Sender Policy Framework is a public list of the mail servers permitted to send on behalf of your domain. When Gmail receives a message claiming to be from you, it looks up your SPF record and checks whether the connecting server's IP is on the list. If not, the check fails.
The catch: SPF only checks the hidden envelope sender, not the From address your reader sees, and it breaks when mail is forwarded. That is exactly why DKIM and DMARC exist to back it up. One practical rule—you may only have a single SPF record, and it must resolve in 10 DNS lookups or fewer.
DKIM in plain English
DomainKeys Identified Mail signs each outgoing message with a private key that only your sending platform holds. The matching public key sits in your DNS. The receiver recreates the signature and compares; if they match, the message is genuine and untouched. Because the seal is attached to the content itself, DKIM keeps working even when a message is forwarded—its biggest advantage over SPF.
DMARC in plain English
DMARC is the policy layer that makes SPF and DKIM useful. It does two jobs. First, it sets a rule for failures: p=none (just watch), p=quarantine (send to spam), or p=reject (bounce it). Second, through the rua tag it emails you daily aggregate reports showing every source sending as your domain—including impersonators.
DMARC also enforces alignment: the domain your reader sees in the From field must match the domain that passed SPF or DKIM. This is the piece that actually stops spoofing, because an attacker can pass SPF for their own server but cannot align it to your visible domain.
How they work together on one message
- You hit send. Your platform signs the message with DKIM and sends from an authorized IP.
- The receiver checks SPF: is this IP allowed to send for the domain?
- The receiver checks DKIM: does the signature match the published public key?
- The receiver checks DMARC alignment: does the visible From domain match a passing check?
- If DMARC fails, the receiver applies your policy—none, quarantine, or reject—and logs it in your report.
The right rollout order
Publish SPF and DKIM first and confirm both pass. Then add DMARC at p=none so you can read reports without risking delivery. After a few weeks of clean reports, move to p=quarantine, then p=reject. Never start at reject—you will silently block your own legitimate mail. You can build all three records without touching raw syntax using our SPF, DKIM & DMARC generator.
Frequently asked questions
Do I need all three, or is one enough?
You need all three. SPF and DKIM each verify different things and both have gaps; DMARC ties them together and is required by Gmail and Yahoo for bulk senders. One alone leaves you exposed to spoofing.
Which comes first, SPF or DKIM?
Order does not matter for setup—publish both. But roll out DMARC last, and only after SPF and DKIM are confirmed passing, so your policy does not block legitimate mail.
Will DMARC block my own emails?
Only if you jump straight to p=reject before fixing unaligned sources. Start at p=none, review the reports, authenticate every legitimate sender, then enforce. Done in order, DMARC blocks impersonators, not you.
What does "alignment" actually mean?
Alignment means the domain in the visible From address matches the domain that passed SPF or DKIM. Without it, a spammer could pass SPF using their own domain while still spoofing yours in the From line.
These three records are the authentication core of a healthy sending program. For the bigger picture—reputation, list hygiene, and inbox placement—read our guide to email deliverability.
Want SPF, DKIM, and DMARC configured for you automatically? Launch with IGSendMail and skip the DNS headache entirely.