Email authentication is a set of checks that prove an email really comes from the domain it says it's from. The three main standards are SPF, DKIM and DMARC. Together, they help your emails reach the inbox and stop scammers from sending emails that pretend to be you.
They sound technical, but you only need to set each one up once. This guide explains what each one does in plain English, shows you what the records look like and walks you through setting them up.
In this article, you'll learn:
- What email authentication is
- How SPF, DKIM and DMARC work together
- Definitions for:
1) SPF
2) DKIM
3) DMARC
- The differences between SPF, DKIM and DMARC
- How to set them up
- How to check your SPF, DKIM and DMARC records
- What comes after SPF, DKIM and DMARC
- Answers to frequently asked questions about email authentication
What is email authentication?
Email authentication is how inbox providers confirm an email is genuinely from the sender it claims to be from. It works through records you publish on your domain, which providers check every time one of your emails arrives.
Email was invented without any built-in way to prove who sent a message. Anyone can type any address into the From line, which is how phishing and spoofing work. SPF, DKIM and DMARC were added later to close that gap.
Why does email authentication matter?
- Your emails reach the inbox. Authenticated emails are trusted more, so they're less likely to be filtered as spam.
- It's now required. Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024, and Microsoft followed in 2025.
- It protects your brand. DMARC stops scammers sending emails that look like they come from your domain, which protects your customers too.
- It protects your sender reputation. Authentication is one of the main signals providers use to judge your domain. For the full picture, see our guide on how to protect your sender reputation.
How do SPF, DKIM and DMARC work together?
SPF and DKIM each check a domain hidden inside your email. DMARC then checks whether at least one of them passed using the same domain as the From address people actually see. This match is called alignment, and it's what makes the whole system work.
Think of it like sending a parcel. SPF checks that the courier is on your approved list. DKIM checks the parcel's seal hasn't been broken. DMARC checks that the name on the seal or the courier's paperwork matches the name on the label, and tells the post office what to do if it doesn't.
Without DMARC, a scammer could pass SPF using their own domain while putting your name in the From line. Alignment closes that loophole.
What is SPF?
SPF (Sender Policy Framework) is a list of the services allowed to send email on behalf of your domain. When an email arrives, the inbox provider checks whether the server that sent it is on your list.
Your SPF record is a single line of text added to your domain's DNS.
Here's an example for a business that sends from Google Workspace and an email marketing platform:
v=spf1 include:_spf.google.com include:mail.example-platform.com ~all
Here's what each part means:
|
Part |
What it does |
|---|---|
|
v=spf1 |
Tells providers this is an SPF record |
| include: |
Adds a service that's allowed to send for you, like your work email or marketing platform |
| ~all |
Says what to do with email from anywhere else. ~all (soft fail) marks it as suspicious. -all (hard fail) says to reject it |
SPF rules to know
- One record per domain. If you have two SPF records, both will fail. Combine every service into one line.
- A 10-lookup limit. SPF can only check 10 DNS lookups. Each
include:uses at least one, so remove services you no longer use. - SPF breaks when emails are forwarded. The forwarding server isn't on your list, which is why DKIM matters too.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. Inbox providers use a public key on your domain to check the signature, which proves the email came from you and wasn't changed along the way.
DKIM uses a pair of keys. Your email platform keeps a private key and uses it to sign each email. You publish the matching public key in your DNS, so anyone receiving your email can check it. A DKIM record looks something like this (the key is shortened here):
selector1._domainkey.yourcompany.com
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
|
Part |
What it does |
|---|---|
|
selector1._domainkey |
The record's name. The selector lets you have different keys for different services |
|
v=DKIM1 |
Tells providers this is a DKIM record v=DKIM1 |
| k=rsa |
The type of key used |
| p= |
Your public key |
DKIM tips
- You'll usually have more than one. Each service that sends email for you, like your work inbox and your marketing platform, needs its own DKIM key and selector.
- Use 2048-bit keys. They're more secure than older 1024-bit keys, and most platforms now use them by default.
- DKIM survives forwarding. Because the signature travels with the email, it still passes when a message is forwarded, unlike SPF.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy that tells inbox providers what to do with emails that claim to be from your domain but fail authentication. It also sends you reports, so you can see who's sending email using your name.
Here's an example DMARC record. It always lives at _dmarc.yourcompany.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com
|
Part |
What it does |
|---|---|
| v=DMARC1 |
Tells providers this is a DMARC record |
| p= |
Your policy: what to do with emails that fail (see below) |
| rua= |
Where to send daily summary reports |
| pct= |
Optional. The percentage of failing emails the policy applies to, useful when tightening it gradually |
| adkim= / aspf= |
Optional. Sets alignment to relaxed (r, the default, which allows subdomains) or strict (s, exact match only) |
What are the three DMARC policies?
|
Policy |
What happens to failing emails |
When to use it |
|---|---|---|
| p=none |
Delivered as normal. You just get reports |
When you're starting and checking that all your genuine email passes |
| p=quarantine |
Sent to the spam folder |
Once your reports show your genuine email is passing |
| p=reject |
Blocked completely |
The strongest protection against spoofing, once you're confident |
p=none is enough to meet Gmail, Yahoo and Microsoft's bulk sender rules. But it doesn't stop anyone spoofing your domain, so aim to move to quarantine or reject over time.
What are DMARC reports?
DMARC reports are daily summaries that inbox providers email to the address in your rua= tag. They show which servers sent email using your domain and whether each one passed SPF and DKIM. The raw files are hard to read, so most businesses use a free or low-cost DMARC reporting tool to turn them into simple charts.
SPF vs. DKIM vs. DMARC: what's the difference?
SPF checks where an email was sent from, DKIM checks that it wasn't tampered with and DMARC checks that both line up with your From address. You need all three, because each one covers gaps the others leave.
|
SPF |
DKIM |
DMARC |
|
|---|---|---|---|
|
Question it answers |
Is this server allowed to send for this domain? |
Was this email signed by this domain and left unchanged? |
Do SPF or DKIM match the From address, and what happens if not? |
|
How it works |
A list of approved senders |
A digital signature checked with a public key |
A policy plus reports |
|
Where it lives |
A TXT record on your domain |
A TXT or CNAME record at a selector |
A TXT record at _dmarc |
|
Survives forwarding? |
No |
Usually |
Depends on DKIM |
|
Stops spoofing on its own? |
No |
No |
Yes, at quarantine or reject |
How to set up SPF, DKIM and DMARC
Setting up email authentication means adding three records to your domain's DNS. It usually takes under an hour, plus a day or two for the changes to spread across the internet.
- List everything that sends email for you. Include your work inbox (like Google Workspace or Microsoft 365), your email marketing platform, your CRM, your online store and any invoicing or helpdesk tools.
- Log in to your DNS settings. These are usually with the company you bought your domain from, or your website host.
- Add or update your SPF record. Create one TXT record that includes every service from step 1. If you already have one, add to it rather than creating a second.
- Turn on DKIM for each service. Each sending tool will give you a DKIM record (or a few CNAME records) to copy into your DNS. Then switch DKIM on inside that tool.
- Add a DMARC record at p=none. Start with monitoring only, and include an
rua=address so you receive reports. - Test, then tighten. Send a test email and check that SPF, DKIM and DMARC all pass. After a few weeks of clean reports, move your DMARC policy toward quarantine and then reject.
How to move from p=none to p=reject
Tighten your DMARC policy in stages, so a forgotten sending service doesn't end up in spam. Most small businesses can reach p=reject within two to three months.
The timings above are a guide, not a rule. Only move to the next step when your DMARC reports show that all your genuine email is passing. If something you recognize starts failing, fix it before tightening further.
How to check your SPF, DKIM and DMARC records
The quickest check is to send an email to a Gmail address you own, open it and choose "Show original" from the menu. Gmail shows PASS or FAIL next to SPF, DKIM and DMARC at the top of the page.
You can also use:
- Free online record checkers (like MXToolbox or a DMARC tool's lookup) to see exactly what's published on your domain and spot syntax errors
- Google Postmaster Tools, whose Compliance status dashboard shows whether your domain meets Gmail's authentication requirements
- Your DMARC reports, which show authentication results for every service sending as your domain
Common email authentication mistakes
|
Mistake |
What happens |
How to fix it |
|---|---|---|
|
Two SPF records on one domain |
SPF fails for every email |
Merge them into a single record |
|
More than 10 SPF lookups |
SPF fails with a "permerror" |
Remove services you no longer use |
|
A sending tool missing from SPF or DKIM |
That tool's emails fail DMARC |
Add it, then check your DMARC reports |
|
DKIM not switched on in the sending tool |
Emails aren't signed, even with the record in place |
Turn DKIM on in the tool's settings |
|
Jumping straight to p=reject |
Genuine emails get blocked |
Start at p=none and tighten in stages |
|
No rua= address in DMARC |
You get no reports, so you can't see problems |
Add a reporting address |
What comes after SPF, DKIM and DMARC?
Once your DMARC policy is at quarantine or reject, you can add BIMI (Brand Indicators for Message Identification). BIMI shows your logo next to your emails in supporting inboxes, like Gmail, Yahoo and Apple Mail, which helps people recognize your emails at a glance.
To use BIMI, you'll need:
- A DMARC policy of p=quarantine or p=reject
- Your logo in a specific SVG format, published at a public web address
- A BIMI record on your domain
- For Gmail and Apple Mail, a mark certificate bought from a certificate provider, usually a verified mark certificate (VMC). Gmail also accepts a common mark certificate (CMC)
BIMI is optional, but it's a nice reward for getting your authentication right.
Email authentication FAQs
Do I need SPF, DKIM and DMARC?
Yes. Gmail, Yahoo and Microsoft require all three from anyone sending 5,000 or more emails a day, and they use them to filter email from smaller senders too. Setting them up is one of the simplest ways to improve deliverability.
Is SPF or DKIM more important?
You need both. DKIM is more reliable because it survives forwarding, but SPF is still required by the major providers. DMARC only needs one of them to pass and align, so having both gives you a backup.
What DMARC policy should I use?
Start with p=none so you can monitor your email without blocking anything. Once your reports show all your genuine email passing, move to p=quarantine and then p=reject for full protection.
How long do DNS changes take to work?
Most changes work within an hour, but they can take up to 48 hours to spread everywhere. Wait a day before assuming something hasn't worked.
Does DMARC stop phishing?
It stops scammers from sending emails that use your exact domain in the From address, once your policy is at quarantine or reject. It can't stop look-alike domains, like yourcompany-support.com, so keep an eye out for those too.
Do I need email authentication if I use an email marketing platform?
Yes. Your platform can sign emails with its own domain, but your emails won't align with your From address unless you authenticate your own domain. Most platforms walk you through adding the records.
The bottom line
SPF says who can send for you, DKIM proves your emails weren't tampered with, and DMARC ties them both to your name and tells inboxes what to do when something's wrong. Set them up once, start DMARC gently and tighten it as your reports come back clean. For more on keeping your emails trusted after that, read our guide on how to protect your sender reputation.
With Transpond, the all-in-one marketing platform for Capsule, you can set up your sending domain so the emails you send from Transpond carry your own domain's authentication.