SPF, DKIM and DMARC explained

Three public DNS records help stop other people sending email that looks like it came from your domain. None of them is a full security product on its own. Together they are the usual baseline for any domain that sends mail — or that you want to protect from being used as a fake “From” address.

You can check yours with our free SPF checker, DKIM checker and DMARC checker, or run the all-in-one scan.

Why this matters for a small business site

If someone else can send email that appears to come from you, customers may get phishing messages, invoices you never sent, or password resets you did not request. Mail providers also use these records when deciding whether to deliver, junk or reject a message. Publishing clear SPF, DKIM and DMARC records will not stop every scam, but it is one of the few DNS changes that both improves deliverability for real mail and makes forged mail easier to spot.

These checks are passive DNS look-ups. They do not prove a website is safe, and they are not a penetration test.

SPF — who may send as you

SPF (Sender Policy Framework) is a TXT record on your domain. It lists the services allowed to send email for that domain — your mailbox host, a newsletter tool, a contact-form or booking service, and so on.

A typical record starts with v=spf1, names one or more services with include: (or similar mechanisms), and ends with ~all or -all. Soft fail (~all) is softer; fail (-all) is stricter. Your email provider will tell you which ending to use.

Rules that catch people out:

• Only one SPF TXT record on the domain. Extra ones break the check — merge them into a single record.
• SPF may follow at most 10 DNS look-ups. Too many include: lines can push you over the limit and make the record fail even when each include looks fine on its own.
• +all means anyone may send as you. Treat that as broken and replace it.
• If you never send email from a domain (for example a parked domain), publish v=spf1 -all so nothing is authorised.
• Each new tool that sends as you (CRM, support desk, marketing platform) usually needs an extra include:. Add it deliberately and re-check the look-up count.

SPF alone does not stop every forged message, because some paths forward mail in ways SPF cannot easily cover. That is one reason DKIM and DMARC exist alongside it.

DKIM — a signature on each message

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail. Receiving servers look up a public key in DNS — usually a TXT record under a selector name such as selector._domainkey.yourdomain — and check that the message was signed with the matching private key and was not altered in transit.

Your email host normally turns DKIM on and gives you the exact DNS name and value to paste. Selector names vary by provider (google, selector1, k1, and many others). Our DKIM checker tries common selector names. If yours uses an unusual selector, a “not found” result may simply mean we did not try that name — check the DNS record your provider gave you.

Rotate keys if your provider asks you to, and remove old selector records you no longer use so they do not clutter DNS.

DMARC — what to do when SPF or DKIM fail

DMARC sits on top of SPF and DKIM. The record lives at _dmarc.yourdomain and starts with v=DMARC1. The important tag is p= (policy):

• p=none — watch and report only. Fake mail is not blocked by DMARC policy alone. This is the usual starting point.
• p=quarantine — ask receivers to treat failing mail as suspicious (for example place it in junk).
• p=reject — ask receivers to refuse failing mail.

Optional tags such as rua= (aggregate reports) and ruf= (failure reports) send XML reports to an address you control or to a reporting service. Reading those reports helps you find legitimate senders that are not yet aligned before you tighten policy.

Most domains start on p=none, fix legitimate senders so they pass SPF or DKIM aligned with the visible From domain, then move to quarantine or reject. Jumping straight to reject while a marketing tool is still unsigned will block real mail.

How the three fit together

SPF answers “was this sent from an allowed place?”. DKIM answers “was this signed by a key published for this domain?”. DMARC says what to do when those checks fail, and ties the visible From domain to the authenticated domain (alignment). Receivers combine these signals with their own filters.

None of them replaces strong mailbox passwords, multi-factor sign-in, or common sense about unexpected attachments.

Practical next steps

1. Run the SPF, DKIM and DMARC checkers on your domain.
2. Add the exact records your email and newsletter providers give you — do not invent the values.
3. Keep a single SPF record under the 10-look-up limit; remove includes you no longer need.
4. Publish DMARC at p=none with a reporting address if you are unsure, then tighten once reports look clean.
5. Re-check after every change; DNS can take a short while to update worldwide.

For a wider pass across HTTPS, headers, links and more, use the free scan.

Informational only. Not a security audit, legal advice or a guarantee.

All guides · Free scan