SPF, DKIM and DMARC: what each one does

SPF, DKIM and DMARC are three DNS records that prove an email sent with your domain name really comes from you. SPF lists the servers allowed to send, DKIM signs each message, and DMARC tells the recipient what to do when the check fails — and sends you reports. Since 1 February 2024, Gmail has required at least one of the first two from every sender.

SPF: who is allowed to send

SPF (Sender Policy Framework) is defined in RFC 7208. It lets a domain owner "explicitly authorize the hosts that are allowed to use their domain names", and lets the receiving server check that authorisation (RFC 7208).

In practice, it's a TXT record starting with v=spf1 that lists your senders: your mailbox provider, your newsletter tool, your CRM.

The classic trap is the 10 DNS lookup limit. The include, a, mx, ptr and exists mechanisms and the redirect modifier each trigger a lookup, and the standard requires stopping at 10: beyond that, the check returns a permanent error (permerror). Every new SaaS tool adds an include… and one day, with nothing changed on the sending side, your emails fail SPF.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail), defined in RFC 6376, "permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message" (RFC 6376).

The sending server adds a DKIM-Signature header to each message. The public key used to verify that signature is published in DNS, under a subdomain named _domainkey: for a selector s1 on example.com, the query is for s1._domainkey.example.com. If the message is altered in transit, the signature no longer matches.

DMARC: the policy and the reports

DMARC ties the first two to the address your recipient actually sees. The reference standard is now RFC 9989, published in 2026 on the Internet Standards Track, which obsoletes the 2015 RFC 7489 (an Informational RFC) (RFC 9989).

Two ideas to remember:

Alignment. For DMARC to pass, it isn't enough for SPF or DKIM to succeed: the domain that succeeded must be "aligned" with the author's domain — the one in the From header — either strictly (identical) or relaxed (same organizational domain).

Policy. The DMARC record expresses what you want when the check fails:

• none: no preference expressed — you observe;
• quarantine: the message is considered suspicious;
• reject: the failure is a clear sign that the use of the domain isn't valid.

DMARC also lets you request reports: aggregate reports (RFC 9990) and failure reports (RFC 9991). They show you who is sending email in your name.

What Gmail requires

Google's sender rules have applied since 1 February 2024 (Google, Email sender guidelines):

• All senders: SPF or DKIM, a spam rate reported in Postmaster Tools below 0.3%, and a TLS connection.
• More than 5,000 messages a day to Gmail: SPF and DKIM, a DMARC record (the policy can be none), a From aligned with the SPF or DKIM domain, and, for marketing emails, one-click unsubscribe with a visible link in the message.

The order to set them up in

1. SPF: list all your real senders, keeping an eye on the 10-lookup limit.
2. DKIM: turn on signing in every tool that sends on your behalf.
3. DMARC at none with reports: watch for a few weeks who sends what.
4. Then move to quarantine, then reject, once every legitimate sender is aligned.

Skipping the observation step is the surest way to block your own invoices or your newsletter.