If you send business email, you want it to actually arrive. SPF, DKIM and DMARC are three techniques that help with that and protect your domain against abuse. In this article, we explain what they do and how to set them up.

Why email authentication?

Without authentication, anyone can pretend to send email on behalf of your domain. This is called spoofing and it is widely abused for:

  • Phishing attacks
  • Sending spam
  • Identity fraud
  • Damaging your domain's reputation

Email authentication proves that email really comes from you and blocks fake messages.

SPF: who is allowed to send email for your domain?

SPF (Sender Policy Framework) is a DNS record that states which servers are allowed to send email for your domain.

How does SPF work?

  1. You publish an SPF record in your DNS
  2. Receiving mail servers check this record
  3. If the sending server is not in your SPF, the email is rejected or marked as suspicious

Example SPF record

v=spf1 include:_spf.theory7.net ~all

This says: only servers of theory7.net are allowed to send email on behalf of this domain.

Setting up SPF

  1. Go to your DNS management
  2. Create a TXT record for your domain
  3. Add your SPF line
  4. Wait for DNS to propagate (max 24-48 hours)

Please note: you can only have 1 SPF record. Do you also send email through other services (a newsletter system, a CRM)? Add them to the same record with include:.

DKIM: is this email genuine?

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send.

How does DKIM work?

  1. Your mail server signs every outgoing email with a private key
  2. The public key is in your DNS
  3. Receiving servers verify the signature
  4. If the signature is valid, the email was not altered in transit

Benefits of DKIM

  • Proves that the email really comes from your server
  • Detects whether email was altered in transit
  • Improves your deliverability
  • Required for DMARC

Setting up DKIM

DKIM requires configuration on your mail server. With most hosting providers, you can turn it on in the control panel:

  1. Activate DKIM in your email management
  2. Copy the generated DNS record
  3. Add it as a TXT record to your DNS
  4. Test whether it works

DMARC: what to do with suspicious email?

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM fails.

How does DMARC work?

  1. The receiving server checks SPF and DKIM
  2. If both fail, the server looks at your DMARC policy
  3. Based on that, the email is let through, quarantined or rejected

DMARC policy options

  • none: monitor only, no action (start with this)
  • quarantine: suspicious email goes to spam
  • reject: suspicious email is refused

Example DMARC record

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.nl

This says: quarantine suspicious email and send reports to dmarc@yourdomain.nl.

Setting up DMARC

  1. First make sure SPF and DKIM work correctly
  2. Start with p=none to monitor
  3. Analyze the reports
  4. Tighten it to quarantine or reject

Step-by-step plan for a complete setup

Follow this order for the best results:

1. Set up SPF

Determine which servers send email on behalf of your domain and create the SPF record.

2. Activate DKIM

Enable DKIM through your hosting provider and add the DNS record.

3. Test

Use tools such as mail-tester.com to check your setup.

4. Add DMARC

Start with monitoring (p=none) and tighten it later.

5. Monitor

Keep an eye on the DMARC reports for problems.

Frequently asked questions

Do I need to set up all three? SPF is the minimum. DKIM is strongly recommended. DMARC makes it complete. For optimal deliverability and protection, you want all three.

My email ends up in spam. Will this help? Yes, correct authentication significantly improves your deliverability. It is one of the first things you should check.

Can I set this up myself? The basics, yes, but it can get technical. With Theory7 hosting, SPF and DKIM are configured automatically.

How do I test whether it works? Send a test email to mail-tester.com or check your email headers for DKIM and SPF results.

What if I use multiple email services? Add all services to your SPF record and configure DKIM for each service. This is common with newsletter tools and CRM systems.

Want to know more about email with your own domain? Read how to set up a business email address or check out our tips for website security.

Looking for a professional email address? See our offer.