SPF, DKIM and DMARC sound like technical jargon. In practice they are three short text records that you add to your domain's settings. Together they answer one question for inbox providers: is this email really from who it says it is from?
Without them, anyone could send email pretending to be your business. With them, Gmail, Outlook and others can check your emails and trust them more.
A simple way to think about it
Imagine your business sends letters through a post office.
- SPF is a list at the post office of couriers you allow to deliver letters for you.
- DKIM is a wax seal on each letter that proves nobody opened or changed it on the way.
- DMARC is your instruction to the post office about what to do with letters that fail those checks, plus a request to send you reports.
Where these records live
All three are added in your domain's DNS settings. DNS is like the address book of the internet. You manage it wherever you bought your domain or where your website is hosted. You will see a page where you can add records of different types, such as TXT and CNAME.
Your email marketing tool will show you the exact values to add. You do not need to write them yourself.
SPF: who is allowed to send
SPF is a TXT record that lists the services allowed to send email using your domain. A simple SPF record looks something like this:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~allIn plain words: "Google and this email tool may send for me. Treat anything else with suspicion."
Two things to know:
- You can only have one SPF record per domain. If you use several services, combine them into one record. Two SPF records will break it.
- SPF has a limit on how many lookups it can do. If you add too many services, it can fail. Your developer can check this with a free SPF checker.
DKIM: a digital seal on every email
DKIM adds a hidden signature to every email you send. Inbox providers use a public key stored in your DNS to check that signature. If the email was changed on the way, the check fails.
Your email tool gives you DKIM records to add, often as CNAME records. They look a bit like this:
k1._domainkey.yourbusiness.com CNAME dkim.mcsv.netYou do not need to understand the cryptography. Paste the values, save, then click verify in your email tool.
DMARC: your rules and your reports
DMARC tells inbox providers what to do when an email fails SPF and DKIM checks. It also asks them to send you reports, so you can see who is sending email using your domain.
A good starting DMARC record is a TXT record on _dmarc.yourbusiness.com that looks like this:
v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.comThe p part is your policy:
- p=none: just watch and report. Start here.
- p=quarantine: send failing emails to spam.
- p=reject: block failing emails completely.
Begin with none. After a few weeks of reports, once you are sure all your real email passes, move to quarantine and later to reject. This protects your brand from people faking your address.
How to check it worked
After adding the records, give them some time. DNS changes can take a few hours to spread. Then:
- Click verify in your email marketing tool.
- Use a free online checker for SPF, DKIM and DMARC.
- Send yourself an email in Gmail, open it, and choose "Show original". You should see SPF, DKIM and DMARC marked as PASS.
Why this matters now
Gmail, Yahoo and Microsoft now require bulk senders to set up SPF, DKIM and DMARC. Even if you send small volumes, having all three gives you a better chance of reaching the inbox and protects your customers from scam emails using your name.
It is a one time job that takes less than an hour. Of everything in email marketing, it may be the best hour you spend.
Mailbox providers update their filters and requirements regularly. This guide was last reviewed on February 17, 2026. Spotted something out of date? Tell us.