SPF vs DKIM vs DMARC: What Each Record Does
SPF, DKIM and DMARC are three DNS records that together prove your email is really from you. SPF lists which servers may send for your domain. DKIM cryptographically signs each message so it can't be altered. DMARC ties the two to your visible From address and tells mailbox providers what to do when a message fails.
The one-paragraph version
Think of a letter arriving at a mailroom. SPF is the approved-couriers list taped to the wall — is this delivery van allowed to drop off mail for this company? DKIM is a tamper-evident seal on the envelope — was this opened or rewritten in transit? DMARC is the mailroom policy that says both checks must line up with the name printed on the letterhead, and here's what to do when they don't.
You need all three. SPF alone breaks the moment mail is forwarded. DKIM alone doesn't stop someone from signing with their own domain while displaying yours in the From line. DMARC without SPF and DKIM has nothing to evaluate.
Side-by-side comparison
| SPF | DKIM | DMARC | |
|---|---|---|---|
| Full name | Sender Policy Framework | DomainKeys Identified Mail | Domain-based Message Authentication, Reporting & Conformance |
| What it verifies | Sending server IP is authorized | Message content wasn't altered and was signed by the domain | SPF or DKIM aligns with the visible From domain |
| DNS record type | TXT at the root domain | TXT at selector._domainkey.yourdomain.com | TXT at _dmarc.yourdomain.com |
| Uses cryptography | No | Yes (public/private key pair) | No — it reads the other two results |
| Survives forwarding | Usually breaks | Usually survives | Passes if either one survives and aligns |
| Produces reports | No | No | Yes — daily XML aggregate reports |
| Can reject mail | Advisory only | Advisory only | Yes, via p=quarantine or p=reject |
SPF: the authorized senders list
An SPF record is a single TXT record at your root domain listing every service allowed to send email as you. A typical one looks like this:
v=spf1 include:_spf.google.com include:sendinggateway.example.net ~all
Reading it left to right: version one of SPF, then delegate authorization to Google's list and your email platform's list, then ~all — a soft fail meaning "anything else is probably not us."
The three mechanisms you'll actually use:
include:— pulls in another domain's SPF record. This is how you authorize your ESP, CRM, help desk and invoicing tool.ip4:/ip6:— authorizes a specific server address. Use for your own mail server only.~allor-all— the closing rule. Soft fail (~all) is the safe default; hard fail (-all) is stricter and only appropriate once you're certain every sender is listed.
SPF has two constraints that trip people up constantly. First, one SPF record per domain. Two SPF TXT records is a permanent error — merge them into one. Second, the 10-lookup limit. Every include: costs a DNS lookup, and nested includes count too. Exceed ten and the whole record returns permerror, which most receivers treat as no SPF at all. Five or six third-party services is usually enough to blow the budget.
DKIM: the tamper-evident signature
DKIM works with a key pair. Your sending platform holds the private key and uses it to sign each outgoing message — specifically a hash of selected headers and the body. The matching public key lives in your DNS. The receiving server fetches that public key, recomputes the hash, and confirms the signature matches.
Two things this proves: the message genuinely came from a system holding your private key, and nothing in the signed portion was modified in transit.
The record lives at a selector subdomain, which is why you can have several DKIM keys at once:
google._domainkey.yourdomain.comfor Google Workspaceigsm1._domainkey.yourdomain.comfor your marketing platformzendesk1._domainkey.yourdomain.comfor support tickets
Each service generates its own selector and key, so there's no shared limit the way there is with SPF lookups. Use 2048-bit keys where your DNS provider allows it — some older providers cap TXT record length and force you to split the value across strings.
DKIM's real advantage is that it usually survives forwarding. When a subscriber auto-forwards your email to another address, the forwarding server's IP is not in your SPF record, so SPF fails. The DKIM signature travels with the message and still validates. This is exactly why DMARC accepts either check.
DMARC: the policy and the feedback loop
DMARC adds the piece SPF and DKIM both lack: alignment. Neither SPF nor DKIM inherently cares about the From address your subscriber actually sees. SPF checks the hidden envelope sender (the Return-Path). DKIM checks whatever domain signed the message. A spammer can pass both while displaying your brand in the From line.
DMARC closes that gap by requiring that a passing SPF or DKIM result use a domain that matches the visible From domain. If neither aligns, DMARC applies your published policy.
A record looks like this:
v=DMARC1; p=none; rua=mailto:[email protected]; pct=100; adkim=r; aspf=r
| Tag | Meaning | Recommended value |
|---|---|---|
p | Policy for failing mail | Start none, end at reject |
rua | Where to send aggregate XML reports | A monitored mailbox or reporting service |
pct | Percentage of failing mail the policy applies to | 100, or lower while ramping |
adkim / aspf | Alignment strictness | r (relaxed) — allows subdomains |
sp | Policy for subdomains | Set explicitly if you use sending subdomains |
The rollout order that doesn't break your mail
Publishing p=reject on day one is the single most common way to accidentally block your own invoices, password resets and sales team's mail. Do it in stages.
- Inventory every sender. Your ESP, CRM, billing system, help desk, HR platform, scheduling tool. Anything that sends as your domain.
- Publish SPF covering all of them, ending in
~all. Verify you're under 10 lookups. - Enable DKIM on every platform. Not just the marketing one — a single unsigned sender will show up as a failure later.
- Publish DMARC at
p=nonewith aruaaddress. This changes nothing about delivery; it just starts the reports flowing. - Read reports for two to four weeks. Find the legitimate senders that are failing alignment and fix them.
- Move to
p=quarantine, optionally atpct=25first. Watch for a week or two. - Move to
p=reject. Now nobody can spoof your domain at any major mailbox provider.
This isn't optional infrastructure anymore. Google and Yahoo both require authentication for bulk senders, and a domain without DMARC increasingly gets treated as suspicious by default rather than neutral.
If you'd rather not hand-write TXT records, the SPF, DKIM and DMARC record generator produces correct syntax for your domain and sending services in a couple of minutes. For the broader picture of how authentication fits alongside warm-up, list hygiene and engagement signals, see the guide to email deliverability.
Common failure patterns
- Two SPF records. Someone adds a second one for a new tool instead of merging. Both become invalid.
- Blown lookup limit. Six or seven
include:statements, each with nested includes. Use SPF flattening or drop unused services. - DKIM enabled but never verified. The record was pasted with a trailing space or the DNS provider auto-appended the domain, producing
selector._domainkey.yourdomain.com.yourdomain.com. - Alignment failure from a subdomain sender. Strict alignment (
adkim=s) rejects a signature frommail.yourdomain.comon a message fromyourdomain.com. Relaxed alignment fixes it. ruapointed nowhere. Reports go to an unmonitored inbox, so nobody ever notices the failing sender before the policy tightens.
Frequently asked questions
Do I need all three records, or is SPF enough?
You need all three. SPF breaks when mail is forwarded, and it doesn't check the From address your recipient actually sees. DKIM survives forwarding, and DMARC is what ties either result to your visible domain and gives you enforcement plus reporting.
How long do SPF, DKIM and DMARC records take to work?
DNS propagation usually completes within a few minutes to a few hours depending on your TTL. Delivery effects are immediate once records resolve, but DMARC aggregate reports arrive on roughly a 24-hour cycle, so allow a couple of days before drawing conclusions.
Can I have more than one DKIM record?
Yes. Each sending service uses its own selector, so you can publish separate DKIM keys for your marketing platform, transactional sender, help desk and mail host simultaneously with no conflict.
What does DMARC p=none actually do?
Nothing to your delivery — it's monitor-only. It instructs receivers to treat failing mail exactly as they otherwise would while still sending you aggregate reports, which is why it's the correct first step in any rollout.
Why is my email still going to spam if SPF, DKIM and DMARC all pass?
Authentication proves identity, not reputation. Passing all three means providers know it's really you; whether they trust you depends on complaint rates, bounce rates, engagement, list quality and sending consistency.
Want authentication handled for you instead of hand-editing DNS? Get started with IGSendMail — automatic SPF, DKIM and DMARC setup, 99% inbox deliverability, unlimited contacts on paid plans from $19/mo, and a free 24-hour migration from your current platform.