SPF, DKIM, and DMARC: What Each One Does and How to Set Them Up Correctly

SPF, DKIM, and DMARC are the three DNS-based authentication methods that tell receiving mail servers whether messages from your domain are legitimate. Without them, your mail fails modern spam filters, and as of early 2024, both Google and Yahoo require all three for bulk senders. Here is what each one does and how to set them up correctly.

What do SPF, DKIM, and DMARC actually do?

Each method handles a different part of the authentication problem:

SPF (Sender Policy Framework) is a DNS record that lists which IP addresses and mail services are authorized to send email on behalf of your domain. When a receiving server gets a message from you, it checks whether the sending IP is on your SPF list. If it is not, the message fails SPF.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The sending server signs the message with a private key; the receiving server checks the signature against the public key published in your DNS. A valid DKIM signature proves the message has not been altered in transit and that it genuinely came from a source that holds your private key.

DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of SPF and DKIM and does two things: it tells receiving servers what to do when SPF or DKIM fail (deliver, quarantine, or reject), and it tells them where to send reports about authentication results for your domain.

All three work together. SPF and DKIM authenticate individual messages. DMARC sets the enforcement policy and gives you visibility into what is passing and failing.

How do you set up SPF for your domain?

An SPF record is a TXT record in DNS, added at the root of your domain (@). It follows this basic structure:

v=spf1 [mechanisms] [qualifier]all

A typical record for a domain sending through Google Workspace and one additional ESP looks like:

v=spf1 include:_spf.google.com include:sendgrid.net -all

The -all at the end means hard fail: reject any sender not listed. Some senders use ~all (soft fail -- mark but deliver) while testing, but -all is the correct production setting for domains with complete sending infrastructure coverage.

Common SPF mistakes to avoid:

• Exceeding 10 DNS lookups. Each include: and a mechanism counts toward a 10-lookup limit. If you go over, the SPF check returns permerror and all authentication fails. Use ip4: or ip6: for known IP ranges instead of include mechanisms where possible.
• Multiple SPF records. Only one TXT SPF record can exist per domain. Combine all your sending sources into a single record.
• Missing sending sources. Forwarding services, automated notification tools, and third-party platforms that send on your behalf all need to be listed or they will fail SPF.

How do you set up DKIM for your domain?

DKIM setup is handled in two places: your email sending platform and your DNS.

Your ESP or mail provider generates a public/private key pair. The private key stays on their servers and signs each outgoing message. You publish the public key in your DNS as a TXT record, typically at a subdomain like selector._domainkey.yourdomain.com.

The "selector" is a label that lets you have multiple DKIM keys (for different sending services) on the same domain. Google Workspace uses google, Mailchimp generates a random selector, Sendgrid uses s1 and s2. Your provider gives you the exact DNS record values to add when you configure DKIM in their settings.

DKIM records look like:

google._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=[public key]"

After adding the record, verify it propagated correctly with a DNS lookup tool or the built-in DKIM checker in your ESP. Most platforms will confirm alignment once the record is live.

How do you set up DMARC for your domain?

DMARC is a TXT record at _dmarc.yourdomain.com. A minimal DMARC record that starts in monitoring mode looks like:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none means take no action -- just report. The rua tag specifies where to send aggregate reports (daily XML files summarizing authentication results).

The correct rollout sequence is:

1. Start with p=none and a reporting address. Let reports accumulate for at least 2-4 weeks.
2. Read the reports to find all sending sources. Identify any that are failing SPF or DKIM alignment.
3. Fix alignment issues: add missing SPF includes, configure DKIM for any ESPs that are missing it, or remove unauthorized sending sources.
4. Move to p=quarantine once you are confident your legitimate mail is passing.
5. Move to p=reject once you have confirmed over several weeks that no legitimate mail is being caught.

Never jump straight to p=reject without the monitoring phase. It will block legitimate mail from any sending source you missed during setup.

What is DMARC alignment and why does it cause failures?

Alignment is the requirement that the domain in your From header matches the domain used in the SPF or DKIM check. This is the source of most DMARC failures.

Example of an alignment problem: you send from yourcompany.com, but your ESP sends through a subdomain like mail.esp-provider.com. The SPF check passes for mail.esp-provider.com -- the ESP is authorized to send from their own domain. But DMARC requires the authenticated domain to match yourcompany.com, not mail.esp-provider.com. The alignment check fails.

The solution is to either configure custom domain alignment with your ESP (they let you sign DKIM with your own domain's key) or add their sending domain as a properly aligned subdomain. Every major ESP has documentation for how to configure DMARC alignment. This is the step most senders skip, which is why DMARC reports often show unexpected failures even after SPF and DKIM are in place.

What do DMARC reports tell you and how do you read them?

DMARC aggregate reports arrive as XML files, usually one per sending source per day. They are not readable as raw XML -- use a DMARC reporting tool to parse them. Free options include Postmark's DMARC report reader and dmarcian's dashboard.

Reports show:

• Which IP addresses sent mail claiming to be from your domain
• How many messages passed or failed SPF and DKIM
• Whether DMARC alignment passed or failed for each sending source
• The policy applied (none, quarantine, or reject)

Any IP you do not recognize sending from your domain is either a misconfigured ESP, a forwarding service, or someone attempting to spoof your domain. DMARC reports are the only way to detect the last case before it damages your sender reputation.

How does email authentication affect cold outreach deliverability?

All three records are required for cold outreach to land in the inbox. Without them:

• Google and Yahoo apply enhanced filtering or outright rejection for bulk senders that fail their 2024 requirements
• Receiving mail servers treat your messages as higher-risk
• Your domain is more susceptible to spoofing, which can get your domain blacklisted before you have sent a single legitimate campaign

Authentication is the baseline. After that, deliverability depends on list quality and engagement signals. A verified list with catch-all scoring applied keeps your bounce rate under the 2% threshold that triggers ESP review. For more on that side of the problem, see the email verification best practices guide and the catch-all domain knowledge base entry.

Frequently asked questions about email authentication methods

What is the difference between SPF, DKIM, and DMARC?

SPF lists the IP addresses authorized to send mail for your domain. DKIM adds a cryptographic signature to each outgoing message. DMARC sets the policy for what happens when SPF or DKIM fail and provides reporting. All three are required -- SPF and DKIM authenticate messages, DMARC enforces a policy and gives you visibility.

Do I need all three or can I just set up one?

You need all three. SPF alone can be bypassed. DKIM alone does not prevent domain spoofing. DMARC alone does nothing without SPF or DKIM in place. Google and Yahoo require all three for bulk senders as of early 2024.

How do I set up SPF for my domain?

Create a TXT record at your root domain starting with v=spf1, then list your authorized sending sources using include: mechanisms or ip4: ranges, and end with -all. Keep the total number of DNS lookups under 10. Combine all sending sources into a single SPF record.

What does a DMARC p=reject policy actually do?

It tells receiving servers to discard any message from your domain that fails both SPF and DKIM alignment -- the message is not delivered. Start with p=none (monitoring only), then p=quarantine, then p=reject once you have confirmed all legitimate mail is passing alignment.

What is DMARC alignment and why does it matter?

Alignment requires the domain in your From header to match the domain used in the SPF or DKIM check. If your ESP sends through their own subdomain without configuring custom DKIM alignment for your domain, DMARC alignment fails even though the underlying SPF and DKIM checks pass. This is the most common source of unexpected DMARC failures.

Why am I still getting spam with SPF and DKIM configured?

Authentication verifies sender identity -- it does not filter content or reputation signals. A spammer who controls a domain can set up valid SPF and DKIM. Spam filtering combines authentication with sender reputation, engagement history, and content analysis. Authentication is necessary but not sufficient.

How does email authentication affect cold outreach deliverability?

All three records are required. Without them, Google and Yahoo apply enhanced filtering or rejection for bulk senders, and your domain is unprotected from spoofing. After authentication is complete, deliverability depends on list quality -- verified addresses, low bounce rates, and proper catch-all handling.