SPF, DKIM and DMARC: Keep Your Mail Out of Spam
This guide explains spf dkim dmarc: the three most important email authentication protocols that determine whether your emails arrive. If you have problems with email delivery, setting up spf dkim dmarc is the first step toward a solution.
You send an important quote, but the client does not receive it. Or worse: your mail ends up in the spam folder. Frustrating, but often preventable. With SPF, DKIM and DMARC you prove that you really are who you say you are.
Why is email authentication important?
Email is old and was never designed with security in mind. Anyone can send a message that appears to come from info@yourcompany.com. Spammers and phishers abuse this every day.
SPF, DKIM and DMARC are protocols that solve this problem. They prove to receiving mail servers that your mail is legitimate.
SPF: who may send mail on behalf of your domain?
SPF stands for Sender Policy Framework. It is a DNS record that defines which mail servers may send mail on behalf of your domain.
How does it work?
- You publish an SPF record in your DNS
- It states which servers may send mail for your domain
- The receiving server checks whether the mail comes from an allowed server
- If not, the mail is rejected or marked as spam
Example SPF record
v=spf1 include:_spf.theory7.net include:spf.protection.outlook.com -allThis says: only servers from Theory7 and Microsoft 365 may send mail on behalf of this domain. All others are rejected (-all).
DKIM: digital signature
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to your mail that proves the content was not altered along the way.
How does it work?
- Your mail server signs every message with a private key
- The public key is in your DNS
- The receiving server verifies the signature with the public key
- If it matches, the mail is authentic and unaltered
DKIM also protects against tampering: if someone changes the content, the signature no longer matches.
DMARC: what to do when checks fail?
DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It tells receiving servers what to do when SPF or DKIM fails.
DMARC policy options
- none: Do nothing, only report (for testing)
- quarantine: Put in spam
- reject: Refuse the mail entirely
Example DMARC record
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.comThis says: put failing mail in spam and send reports to dmarc@yourdomain.com.
How do you set it up?
Step 1: add an SPF record
Add a TXT record to your DNS with your SPF configuration. Ask your hosting and mail provider which servers you need to include.
Step 2: activate DKIM
DKIM is usually set up by your mail provider. You get a TXT record to add to your DNS.
Step 3: add a DMARC record
Start with p=none to monitor. Review the reports and then switch to quarantine or reject.
Testing your settings
Use online tools to check whether everything is set correctly:
- mail-tester.com: Send a test mail and get a score
- mxtoolbox.com: Check your DNS records
- dmarcanalyzer.com: Analyze DMARC reports
Frequently asked questions
Do I have to set up all three?
Ideally yes. SPF and DKIM are the basis, DMARC completes it. Without DMARC, receivers do not know what to do when there is a problem.
Can I use multiple mail providers?
Yes, add all providers to your SPF record. Note: you may have a maximum of 10 DNS lookups in SPF.
My mail still ends up in spam, now what?
Also check your mail content. Too many links, suspicious words or bad HTML can also be spam triggers.
Need help?
SPF in detail
SPF (Sender Policy Framework) is a TXT record in your DNS that indicates which servers may send mail on behalf of your domain.
How SPF works
When you send a mail, the receiving server checks: "Is the sending server in the SPF record of this domain?" If so, it is probably legitimate. If not, it may be spam or phishing.
Setting up SPF
A basic SPF record looks like this:
v=spf1 include:_spf.google.com ~all
This says: only Google may send mail on behalf of this domain. ~all means that other servers get a "softfail" (a warning but not blocked).
DKIM in detail
DKIM (DomainKeys Identified Mail) adds a digital signature to your emails. The recipient can verify that the mail was not changed along the way.
How DKIM works
- Your mail server signs every message with a private key
- The public key is a TXT record in your DNS
- The recipient verifies the signature with that public key
Setting up DKIM
Your hosting provider or email service generates the DKIM key. You add the TXT record to your DNS. The exact steps differ per provider, follow their documentation.
DMARC in detail
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It tells recipients what to do when verification fails.
DMARC policy options
- none: monitor only, no action
- quarantine: send to spam
- reject: refuse the mail entirely
Setting up DMARC
Start with a monitor-only policy:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
You receive reports about who is sending mail on behalf of your domain. If everything looks good, you tighten to quarantine and later reject.
Implementing step by step
- Inventory: which services send mail on behalf of your domain?
- Set up SPF: add all legitimate sources
- Activate DKIM: at your email provider and other services
- Start DMARC: begin with p=none to monitor
- Analyze: review the reports and correct problems
- Tighten: move to quarantine and later reject
Testing
Use tools to check your setup:
- mail-tester.com: send a test mail and get a report
- MXToolbox: check your DNS records
- Google Postmaster Tools: see how Gmail views your domain
SPF, DKIM and DMARC for different situations
Simple setup (own mail server only)
If you only send mail from your hosting server, the setup is relatively simple. Your provider often has SPF and DKIM set up by default.
More complex setup (multiple services)
Do you use services such as Mailchimp, SendGrid or a CRM in addition to your own mail server? Then each service needs to be in your SPF record and to have its own DKIM keys.
An SPF record with multiple sources:
v=spf1 include:_spf.hosting.nl include:servers.mcsv.net include:sendgrid.net ~all
Google Workspace or Microsoft 365
For business email via Google or Microsoft, follow their specific instructions for SPF and DKIM. They provide the exact DNS records you need to add.
Common mistakes
- Multiple SPF records (there may only be one)
- Too strict a DMARC policy without monitoring first
- Forgetting to add a new email service
- Not cleaning up old records after switching providers
Correct email authentication makes sure your messages arrive where they should be. Take the time to set it up correctly and test regularly.
Email verification via SPF, DKIM and DMARC is indispensable nowadays. Large email providers such as Gmail and Outlook have become increasingly strict. Without the right authentication records, your mail ends up in the spam folder or is refused entirely.
The one-time technical setup is worth it. Ask your hosting provider for help if you get stuck, they can often create the right records for you. Once set up, you do not have to look at it again. Your mail is delivered reliably and you protect your domain name against abuse by spammers.
Email verification prevents your messages from ending up in spam. Set up SPF, DKIM and DMARC correctly and your mail reliably reaches its destination. It takes some puzzling, but it is more than worth the effort.
Email authentication is complex but essential. Take the time to understand it properly and implement it correctly for reliable mail delivery.
Correct email authentication is the key to reliable communication with your clients.
How SPF, DKIM and DMARC work together
SPF, DKIM and DMARC do not work in isolation but together form a layered security system for your email. Here is how the three protocols work together:
| Protocol | Question it answers | What it checks |
|---|---|---|
| SPF | Is the sending server authorized? | IP address of the sender |
| DKIM | Is the message unaltered and authentic? | Digital signature in the header |
| DMARC | What should happen on a mismatch? | Alignment of SPF and DKIM with the From address |
The verification process step by step
- A mail is sent from your domain
- The receiving server checks the SPF record: is the IP address of the sending server in the list?
- The receiving server verifies the DKIM signature: does the signature match the public key in DNS?
- The receiving server checks DMARC alignment: do SPF and/or DKIM match the From address?
- Based on the DMARC policy, the mail is accepted, quarantined or rejected
- A report is sent to the address in the DMARC record
SPF, DKIM and DMARC: implementation in the right order
Implementing SPF, DKIM and DMARC correctly requires a structured approach. Do not jump straight to a strict policy, but build up gradually:
Phase 1: inventory (week 1)
Make a list of all services that send email on behalf of your domain. Think of your mail server, CRM system, email marketing platform, billing software and any web forms.
Phase 2: set up SPF and DKIM (week 1-2)
Set up SPF with all identified sources. Activate DKIM at every service that supports it. Test with mail-tester.com or mxtoolbox.com whether the configuration is correct.
Phase 3: DMARC monitoring (week 2-6)
Set up DMARC with the policy p=none. You now receive reports about all mail that is sent on behalf of your domain. Analyze the reports to identify missing sources.
Phase 4: tightening (week 6+)
If the reports look good and all legitimate sources are configured correctly, tighten to p=quarantine. After a stable period you can move to p=reject for maximum protection.
Want to know more about email? Read our article about migrating email to new hosting or take a look at the business email solutions from Theory7.
At Theory7 we help you set up SPF, DKIM and DMARC correctly. Get in touch if your mail ends up in spam.
SPF DKIM DMARC summary and best practices
Configuring spf dkim dmarc correctly is essential for every professional email setup. Here are the most important points of attention when setting up spf dkim dmarc for your domain.
- Always start with SPF and then add DKIM before you activate DMARC
- Test your spf dkim dmarc configuration with online tools before you set a strict policy
- Use a professional email address on your own domain
- Configure DMARC first with p=none to receive reports without blocking emails
- Check your domain name DNS settings regularly for correct records
With the right spf dkim dmarc configuration you prevent your emails from ending up in spam. Register your domain via our domain name checker and set up spf dkim dmarc right away for optimal email delivery.
Setting up spf dkim dmarc correctly is no longer a luxury nowadays, but a necessity. Without spf dkim dmarc your emails are more often marked as spam or even refused entirely. Make sure your spf dkim dmarc records are always up to date and check them after every change in your DNS configuration. With well-configured spf dkim dmarc you not only protect your own domain, but you also contribute to a safer email ecosystem.
SPF DKIM DMARC: practical implementation step by step
The theory behind spf dkim dmarc is important, but the practical implementation is what it is all about. For SPF you start by taking inventory of all servers and services that send email on behalf of your domain. This includes your own mail server, your hosting provider, any marketing tools such as Mailchimp or ActiveCampaign, and transactional email services such as SendGrid or Amazon SES. Every legitimate sending server must be included in your SPF record.
An SPF record is a TXT record in your DNS settings. It always starts with v=spf1 and ends with -all (hard fail) or ~all (soft fail). Between these elements you specify the authorized servers via IP addresses or include statements. Watch the limit of a maximum of 10 DNS lookups per SPF record. Use tools such as MXToolbox to test your SPF record and check the number of lookups.
DKIM configuration is technically more complex but just as important. You have to generate a cryptographic key pair: a private key on your mail server and a public key as a TXT record in your DNS. Most email hosting providers offer DKIM configuration through their control panel.
Setting up and monitoring a DMARC policy
After configuring SPF and DKIM correctly, it is time to set up DMARC. Always start with a monitoring policy (p=none) so you can see which emails do and do not pass authentication, without legitimate messages being blocked. Set up a rua address where DMARC reports are sent.
Analyze the DMARC reports for at least two to four weeks. Look for legitimate sources that fail on SPF or DKIM and add these to your configuration. Only after all legitimate sources are authenticated correctly do you tighten the DMARC policy step by step to quarantine and eventually to reject. This phased process prevents you from accidentally blocking legitimate emails.
DMARC reports are XML files that are hard to read manually. Use a free service such as DMARC Analyzer or Postmark to display the reports visually. Combine this with a well-configured DNS configuration for maximum email delivery.
SPF DKIM DMARC: frequently asked questions answered
Do I have to set up all three protocols? Yes, for optimal email delivery you need all three. SPF verifies the sending server, DKIM guarantees the integrity of the message, and DMARC tells receiving servers what to do when a check fails. Together they form a complete security layer.
How long does it take before changes work? DNS changes usually propagate within 24-48 hours. Lower the TTL to 300 seconds before you make changes for faster propagation.
What if my emails still end up in spam? Check whether your emails arrive at all and whether all records are correct. Use the email headers to check whether all authentication checks pass. If the technical configuration is correct, the problem may lie in the content of your messages or the reputation of your sending IP address. Build your reputation gradually by consistently sending good emails.
Testing email authentication with online tools
After setting up spf dkim dmarc it is crucial to test the configuration with online tools. Send a test mail to check-auth@verifier.port25.com to receive an automatic report on your SPF, DKIM and DMARC status. Google also offers a handy tool via the Gmail headers: open a received test mail in Gmail, click the three dots and choose Show original. Here you see whether SPF and DKIM pass or fail.
In addition, use dmarcian.com for free DMARC monitoring. This tool visualizes your DMARC reports and identifies problems. MXToolbox offers an extensive suite for testing DNS records, blacklist checks and SMTP diagnostics. Run these tests monthly to make sure your configuration keeps working correctly, especially after changes to your email infrastructure or adding new sending services.
Do not forget to also set up your email on your own domain name correctly for a professional look and optimal deliverability.
Finally, it is important to document your email authentication configuration. Create an overview of all DNS records with their current values, the date of the last change and the reason for the configuration. Keep this document in a safe, central location. When you add new email services or switch providers in the future, you have an immediate reference to update the configuration correctly. A well-documented SPF/DKIM/DMARC setup saves you hours of troubleshooting and prevents email delivery problems.
Also do not forget that email authentication is an ongoing process, not a one-time configuration. Every time you add a new email service, enable a marketing tool or switch mail servers, you have to update your SPF, DKIM and DMARC records. Schedule a quarterly review to check your email authentication and make sure all three protocols stay configured correctly.
