SPF, DKIM and DMARC Explained: Why Your Emails Go to Spam
3 min read4 October 2026By Muhammad Abdullah
Email was designed with no way to check who really sent a message, so anyone can put your address in the From line. SPF, DKIM and DMARC are three DNS records added later to fix that. Without them, mail providers cannot tell your real emails from forgeries, and they increasingly send unauthenticated mail to spam or reject it outright.
SPF: which servers may send for you
SPF is a TXT record on your domain listing the servers and services allowed to send mail for it. A receiving server checks whether the message came from one of them.
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net ~all"- Have exactly one SPF record. Two separate SPF records make the check fail, so merge every service into one.
- Include every service that sends as your domain: your mailbox provider, newsletter tool, helpdesk and online shop.
- SPF allows at most 10 DNS lookups. Each
includecan use several, and going over makes SPF fail for everyone. ~allmarks anything else as suspicious,-allsays to reject it. Start with~alluntil you are sure the list is complete.
DKIM: a signature on every message
DKIM has the sending service sign each email with a private key. The matching public key is published in your DNS under a name called a selector, and the receiver uses it to confirm the message was signed by you and not changed on the way.
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."You do not create DKIM keys by hand. Each sending service gives you the record to add, and you turn signing on in its settings. Every service that sends for you needs its own DKIM set up.
DMARC: what to do when checks fail
SPF and DKIM each check something, but neither tells the receiver what to do with a failure, and neither checks that the domain they verified matches the From address the reader sees. DMARC does both: it requires SPF or DKIM to pass for a domain that aligns with the visible From address, and it sets a policy for messages that do not.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"p=none: take no action, just send me reports. The safe place to start.p=quarantine: put failing mail in spam.p=reject: refuse failing mail entirely.rua: where receivers send daily summary reports of who is sending as your domain.
Why this is no longer optional
Since 2024, Gmail and Yahoo require SPF or DKIM on all mail sent to them, and bulk senders, those sending around 5,000 or more messages a day to their users, must have SPF, DKIM and a DMARC record. Mail that does not meet the rules is increasingly filtered or rejected. Even a small business sending invoices benefits, because authenticated mail is simply trusted more.
Checking your setup
Look up the TXT records for your domain, for _dmarc on your domain, and for your DKIM selector, and confirm each exists and is written correctly. DNS changes can take from minutes to a few hours to show everywhere, so check again if a record you just added does not appear yet.
Common questions
Do I need SPF, DKIM and DMARC?
Yes, all three. SPF and DKIM prove a message is from you, and DMARC ties them to the visible From address and tells receivers what to do when checks fail.
Can I have two SPF records?
No. Multiple SPF records cause SPF to fail. Combine all your sending services into a single SPF record.
What DMARC policy should I start with?
Start with p=none and a reporting address, review the reports, then move to quarantine and finally reject once all legitimate mail passes.