SPF, DKIM, and DMARC Explained in Plain English (2026)

A client of mine sent 3,000 emails last March. Forty-seven replied. He thought that was bad copy. I looked at his domain and within 30 seconds found that he had no DMARC record, his SPF was pointing to a sending tool he stopped using in 2023, and his DKIM key had never been properly configured.

His emails were reaching inboxes. Some of them. The rest were going straight to spam, and Gmail was routing them there because his domain looked like it might be spoofed. It did not look spoofed because someone was pretending to be him. It looked spoofed because he had no proof that he was who he said he was.

That is the problem SPF, DKIM, and DMARC solve.

None of these are complicated once you understand what they actually do. Most of the confusion comes from guides that explain the technical implementation before explaining what each record is for. This guide does it the other way around.

What are SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are three DNS records that together prove your emails are genuinely from you. Without them, any mail server on the internet can claim to send email from your domain, and receiving servers have no technical way to know the difference.

Here is each one in one sentence:

• ❱SPF (Sender Policy Framework) is a list of the servers and IP addresses that are allowed to send email on behalf of your domain.
• ❱DKIM (DomainKeys Identified Mail) is a cryptographic signature applied to every email you send, which proves the email came from your domain and was not modified in transit.
• ❱DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a policy that tells receiving mail servers what to do when an email fails SPF or DKIM, and sends you reports about those failures.

The analogy that actually helps:

You need all three because they protect against different things. SPF alone can be bypassed. DKIM alone does not tell you who sent the email. DMARC alone does nothing if SPF and DKIM are not configured first.

Why email authentication matters

Without SPF, DKIM, and DMARC configured on your domain, anyone can send email that appears to come from you. This is not theoretical. Domain spoofing is one of the most common techniques in phishing attacks, and the reason it works so often is that most domains have incomplete or missing authentication records.

The practical impact goes beyond security. Gmail, Outlook, Yahoo Mail, and every other major inbox provider use authentication records as a signal when deciding whether to deliver your email to the inbox or route it to spam. A domain with missing authentication records looks exactly like a spoofed domain to their filters. The result is the same: spam folder.

Here is how the four main threats break down:

Google's February 2024 bulk sender requirements made DMARC mandatory for anyone sending 5,000 or more emails per day to Gmail addresses. Yahoo implemented the same requirements at the same time. For senders below that threshold, the absence of DMARC is still a visible red flag that depresses inbox placement.

The Verizon Data Breach Investigations Report consistently finds phishing involved in roughly 36% of data breaches. Most of those phishing emails work because the sending domain lacks proper DMARC enforcement.

What is SPF?

SPF (Sender Policy Framework) is a DNS record that lists every server and IP address that is authorized to send email using your domain name. When an email arrives at a receiving mail server claiming to be from your domain, the server checks your SPF record. If the sending IP is on your approved list, SPF passes. If not, it fails.

SPF is the first line of defense against someone sending email that appears to come from your domain without your permission.

How SPF records work

An SPF record is a TXT record in your domain's DNS settings. It looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Breaking this down:

• ❱v=spf1 tells the receiving server this is an SPF record
• ❱include:_spf.google.com authorizes Google Workspace to send on your behalf
• ❱include:sendgrid.net authorizes SendGrid to send on your behalf
• ❱~all means "soft fail" - emails from any other source should be treated with suspicion but not outright blocked

The ~all qualifier is the cautious option. -all is the strict version (reject anything not on the list). Most senders use ~all initially to avoid accidentally blocking legitimate emails during setup.

The most common SPF mistakes

SPF setup checklist

What is DKIM?

DKIM (DomainKeys Identified Mail) is a cryptographic signature applied to every email you send. The signature proves two things: the email genuinely came from a server authorized by your domain, and the email was not modified after it was sent.

SPF tells receiving servers which IP addresses can send for your domain. DKIM goes further: it proves the actual content of the email is intact and untampered.

How DKIM works

DKIM uses a public/private key pair:

Think of it like a fingerprint. The private key creates the fingerprint. The public key lets anyone verify it belongs to you. Changing even one character in the email body invalidates the fingerprint entirely.

A DKIM signature in an email header looks like this:

DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=selector1;
  h=from:to:subject:date; bh=BASE64_HASH; b=BASE64_SIGNATURE

The d= field is your domain. The s= field is the selector, which points to the specific DKIM key record in your DNS.

Why DKIM matters beyond authentication

DKIM has one property SPF does not: it survives email forwarding. When an email is forwarded, the sending IP changes, which means SPF fails. But DKIM is attached to the message itself, not the server, so the signature remains valid even after forwarding. This is why DKIM is a stronger authentication signal than SPF alone.

DKIM setup checklist

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the policy layer that ties SPF and DKIM together. It tells receiving mail servers what to do when an email claims to come from your domain but fails SPF or DKIM checks. It also gives you visibility: you receive reports about emails that pass or fail on your domain, which is how you find out if someone is spoofing you.

DMARC is what makes SPF and DKIM actionable. Without DMARC, receiving servers know an email failed authentication but have no instruction from you about what to do next. With DMARC, you control the outcome.

The three DMARC policy options

What DMARC alignment means

DMARC requires alignment, which means the “From” domain in your email must match the domain in your SPF or DKIM record. This is what prevents attackers from using a legitimate SPF record from one domain to send email appearing to be from another. Strict alignment requires an exact match. Relaxed alignment (the default) allows subdomain matches. For most senders, relaxed alignment is the right setting.

What a DMARC record looks like

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; pct=100

• ❱v=DMARC1 identifies this as a DMARC record
• ❱p=quarantine is the policy
• ❱rua= is the email address to receive aggregate reports
• ❱pct=100 means apply this policy to 100% of failing emails (you can set this lower during testing)

Use the Vortenza DMARC Record Generator to build a valid DMARC record for your domain without manually writing the syntax.

DMARC setup checklist

SPF vs DKIM vs DMARC

The impact column matters. SPF and DKIM each meaningfully improve deliverability on their own. But DMARC is the record that moves inbox placement the most because it signals to Gmail, Outlook, and Yahoo Mail that you are actively managing your domain's authentication. A domain with p=reject has demonstrably better inbox placement than one with p=none, all else being equal.

BIMI is worth knowing about: it is a newer standard that lets you display your brand logo next to authenticated emails in supporting inboxes. Gmail, Yahoo Mail, and Apple Mail support it. It requires a DMARC policy at p=quarantine or p=reject, plus a Verified Mark Certificate. It does not directly improve spam filter scores but it builds visual trust with recipients, which affects open rates.

Why emails go to spam even when authentication is configured

Authentication is necessary but not sufficient. This is the thing most guides miss.

Passing SPF, DKIM, and DMARC proves your emails are genuinely from you. It does not prove your emails are wanted. Gmail and Outlook use authentication as a baseline check, but they also weigh dozens of other signals when deciding where to place your email.

Here is how authentication problems differ from reputation problems:

Authentication is the floor. Reputation is the ceiling. You need both.

The Vortenza Email Spam Score Checker catches content-level issues in your emails alongside authentication problems, which gives you a more complete picture of why a specific email is landing in spam.

How to check if SPF, DKIM, and DMARC are working

The fastest way to check all three records at once is the Vortenza SPF DKIM DMARC Checker. Enter your domain name and it checks all three DNS records in real time, gives you a color-coded result for each, and shows you exactly what needs fixing in plain English.

Beyond the DNS checker, Google Postmaster Tools shows your sender reputation and authentication pass rates specifically for Gmail delivery. Set it up if you send any significant volume to Gmail. It is free and the data it provides is more useful than any third-party tool.

Common SPF, DKIM, and DMARC errors

Most authentication failures are caused by a small set of recurring mistakes.

Best practices for email deliverability in 2026

Authentication is table stakes. These are the practices that separate senders with consistent inbox placement from those who fight fires after every campaign.

Quick answers

Optimized for ChatGPT, Gemini, Perplexity, Claude, and Google AI Overviews.

Frequently asked questions

Tools used in this guide

Related guides