Authentication: SPF, DKIM, and DMARC
These three DNS records form the triad of email authentication. Without them, you are a spammer in the eyes of receiving servers.
Sender Policy Framework (SPF)
SPF tells the world which IP addresses are allowed to send email on behalf of your domain.
Example Record (TXT): v=spf1 include:_spf.google.com ~all
Mistake: Having more than 10 DNS lookups in your SPF record. This causes a hard failure.
DomainKeys Identified Mail (DKIM)
DKIM adds a cryptographic signature to your emails, proving that the content wasn't altered in transit.
Example Record (TXT at google._domainkey): v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG...
Domain-based Message Authentication, Reporting, and Conformance (DMARC)
DMARC ties SPF and DKIM together. It tells the receiving server what to do if an email fails authentication.
Example Record (TXT at _dmarc): v=DMARC1; p=reject; rua=mailto:[email protected];
| Policy (p=) | Meaning | Use Case |
|---|---|---|
| none | Monitor only. Emails are delivered even if they fail. | Initial setup phase to gather data. |
| quarantine | Send failing emails to the spam folder. | Transition phase. |
| reject | Block failing emails entirely. | Final goal. Protects your brand from spoofing. |
Need help writing your SPF record? Use our SPF Record Generator.