Guides · HolicSecurity

SPF, DKIM and DMARC explained

Published 2 November 2026

In short: SPF lists who may send mail for your domain, DKIM signs each message, and DMARC tells receivers what to do when a message claiming to be from you fails both, and sends you reports. You need all three to stop spoofing and to reach inboxes reliably.

Why it matters

Anyone can put your domain in the From: line of an email. Without authentication, receivers can't tell your invoices from a phisher's. Since February 2024, Google and Yahoo require SPF or DKIM from every sender, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to their users. Missing records now mean spam folders, not just risk.

SPF: who may send

A TXT record on your domain, such as v=spf1 include:_spf.google.com include:sendgrid.net ~all. Keep exactly one SPF record, stay under 10 DNS lookups, and end with ~all or -all. Check it with our SPF checker.

DKIM: a signature on every message

Your mail service signs outgoing messages with a private key and you publish the public key as a TXT record at selector._domainkey.yourdomain.com. Receivers verify the signature, proving the message wasn't altered and was authorised by the domain. Turn DKIM on in every service that sends as you: Google Workspace, Microsoft 365, your newsletter and CRM tools. Each gives you the record to publish.

DMARC: the policy and the reports

A TXT record at _dmarc.yourdomain.com. A message passes DMARC if SPF or DKIM passes and the domain it checked aligns with the visible From: domain. Your policy says what to do with failures: none (report only), quarantine (spam folder) or reject.

A step-by-step rollout

List every service that sends email as your domain.
Publish one SPF record that includes them all.
Enable DKIM in each service and publish its keys.
Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
Read the aggregate reports for two to four weeks and fix any legitimate sender that fails.
Move to p=quarantine, then p=reject.

Domains that never send mail should publish v=spf1 -all and v=DMARC1; p=reject straight away.

Check your domain

Run the DMARC checker and the SPF checker. Both look up public DNS from your browser and take seconds.

Frequently asked questions

Do I need all three?

Yes for reliable delivery and real spoofing protection. SPF and DKIM authenticate; DMARC links them to the From: address and enforces a policy.

Will p=reject block my own email?

Only senders that fail both SPF and DKIM alignment. That's why you start with p=none and read the reports first.