pixie.
ESLet’s talk
DOMAIN, HOSTING AND EMAILTechnical

SPF, DKIM and DMARC: make your email reach the inbox

What SPF, DKIM and DMARC are, how they are set up in DNS and how to check that your email does not end up in spam or get forged in your name.

By Pixie Estudio4 min read

If your emails land in spam, or if someone sent fake messages using your address, authentication is almost always missing. SPF, DKIM and DMARC are three mechanisms configured in your domain's DNS that let the receiving server check that a message really came from a sender you authorized.

This technical guide explains what each one does, how the records are written and in which order it is best to implement them. You need access to the DNS zone of the domain; if you are not sure what a TXT record is, start with the guide on DNS records.

SPF, DKIM and DMARC: what problem they solve

Email was designed without verifying the sender: anyone can type any address in the "From" field. Authentication adds three checks, all based on TXT records of the domain:

  • SPF declares which servers can send email on behalf of the domain.
  • DKIM signs every message with a cryptographic key; the receiver verifies the signature with the public key published in DNS.
  • DMARC defines what the receiver should do if SPF and DKIM fail, and asks for reports.

Without them, email providers distrust the message. With them, deliverability improves and the risk of impersonation is reduced.

SPF: who can send

It is a TXT record at the root of the domain that starts with v=spf1. For example:

v=spf1 include:_spf.google.com ~all
  • include: authorizes the servers of a service (here, Google Workspace's).
  • ~all marks as "suspicious" everything that is not listed; -all rejects it. Start with ~all and move to -all when you are sure.

Key rules:

  • A domain must have a single SPF record. If you use more than one service (email, newsletter, invoicing), they are combined into one record with several include: entries.
  • SPF allows up to 10 DNS lookups per validation. Too many include: entries make it fail.

Google explains the values in its help page on how to set up SPF.

DKIM: the signature of the message

The email service generates a pair of keys: the private one signs the messages and the public one is published in DNS, in a TXT record with a name such as selector._domainkey.yourcompany.com.ar. The selector is a label that your provider gives you.

The usual steps:

  1. In the panel of your email service, generate the DKIM key.
  2. Copy the record name and the value it shows you.
  3. Create the TXT record in your DNS with exactly that data.
  4. Go back to the panel and turn on signing.

Be careful with long values: some DNS panels cut them or add quotation marks. Google details the process in set up DKIM.

DMARC: the policy

It is a TXT record at the name _dmarc.yourcompany.com.ar. An initial example:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com.ar
  • p=none: monitor without affecting delivery. It is the starting point.
  • p=quarantine: send messages that fail to spam.
  • p=reject: reject them.
  • rua=: address where aggregate reports arrive.

DMARC only passes if SPF or DKIM pass and in addition the domain in "From" matches the one that authenticated (alignment). That is why it is best to have both. Google's help explains how to set up DMARC.

  1. Inventory of senders: list every service that sends email with your domain (corporate email, website forms, newsletter, invoicing, CRM).
  2. SPF with all those services in a single record.
  3. DKIM in every service that allows it.
  4. DMARC at p=none for a few weeks, reading the reports.
  5. Tighten: move to quarantine and, with clean reports, to reject.

Jumping straight to reject without reviewing the reports can block legitimate email from a service you forgot to include.

How to test that it works

  • Send a message to a Gmail account, open it and choose Show original: you will see the SPF, DKIM and DMARC results (PASS or FAIL).
  • Query the records from the terminal:
dig yourcompany.com.ar TXT
dig _dmarc.yourcompany.com.ar TXT
dig selector._domainkey.yourcompany.com.ar TXT
  • Review the DMARC reports that arrive: they show who is sending on behalf of your domain.

Website forms and transactional email

Contact forms usually send email from your website's server. If they do so with an address of your domain, that server has to be authorized in SPF and sign with DKIM; otherwise the messages may go to spam. A robust alternative is to use a dedicated sending service and authenticate it with your domain.

Common mistakes

  • Two SPF records on the same domain.
  • Exceeding the lookup limit with too many include: entries.
  • Forgetting a service that sends as you and moving to reject.
  • Copying the DKIM key wrongly (cuts, spaces, quotation marks).
  • Not looking at the DMARC reports and staying at p=none forever.
  • Using -all too early.

Frequently asked questions

Do I need all three?

It is recommended, yes. SPF and DKIM authenticate; DMARC defines the policy and gives you visibility.

Does this guarantee my emails will not go to spam?

It does not guarantee it: reputation, content and sending habits also matter. But without authentication it is much more likely that they will.

How long does it take to apply?

DNS changes can take a while depending on the TTL of the record. Test after a little while.

What to do next

If you would like us to review the authentication of your email or migrate your professional email, take a look at the website tune-up or get in touch. And to review the general security of your site, continue with the guide on website security.

More guides