Learn
Authentication
How SPF, DKIM and DMARC prove an email really comes from you — and why inbox providers now require all three.
8 min read
The problem authentication solves
The protocol that moves email, SMTP, lets any server claim to send as any address. Without authentication, anyone could send mail "from" your domain, and receivers would have no way to tell it apart from yours.
SPF, DKIM and DMARC close that gap. Each answers a different question, and they are designed to be used together.
SPF: which servers may send
Sender Policy Framework is a TXT record on your domain listing the servers allowed to send its mail. The receiving server checks the connecting IP against that list.
Each include:, a, mx, ptr, exists and redirect costs a DNS lookup, and SPF allows at most 10. Go over and SPF fails for every message — the most common SPF mistake, usually caused by adding one provider too many.
v=spf1 include:_spf.google.com include:amazonses.com ~allA domain must have exactly one SPF record. To add a provider, add its include: to the existing record — never publish a second one.
DKIM: the message is genuine
DomainKeys Identified Mail adds a cryptographic signature to each message. The sender signs with a private key; the public key is published in DNS under a selector, at <selector>._domainkey.<domain>. The receiver fetches the key and verifies the signature.
A valid signature proves the message came from someone holding your key and wasn't altered in transit. Unlike SPF, it survives forwarding. Use 2048-bit keys; 1024-bit keys are considered weak.
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…DMARC: what to do when checks fail
SPF and DKIM on their own only report a result. DMARC ties them to the address people actually see — the From: header — and tells receivers what to do when neither passes in alignment with it.
A message passes DMARC when SPF or DKIM passes for a domain that aligns with the From: domain. DMARC also asks receivers to send you daily reports showing every source sending as your domain.
- p=none — monitor only: failing mail is still delivered. Start here and read the reports.
- p=quarantine — failing mail goes to spam.
- p=reject — failing mail is refused outright. The goal once every legitimate source passes.
v=DMARC1; p=quarantine; rua=mailto:[email protected]What inbox providers require
Since 2024, Gmail and Yahoo require senders of more than 5,000 messages a day to their users to have SPF, DKIM and a DMARC record (p=none is acceptable), to align the From: domain, and to support one-click unsubscribe for marketing mail. Smaller senders need at least SPF or DKIM.
In practice every sender should set up all three: it costs a few DNS records and measurably improves inbox placement.