iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SPF, DKIM and DMARC are three email-authentication standards that work together to help receiving mail services verify who is allowed to send for your domain and whether that identity matches the address people see. SPF authorizes sending systems, DKIM supplies a verifiable message signature, and DMARC checks alignment and tells receivers what policy to apply. To set them up safely, first identify every service that sends mail for your domain; the correct DNS records depend on those services and your domain configuration.
What SPF, DKIM and DMARC each do
Think of the three standards as answering different questions. SPF asks whether a sending system is authorized for a domain. DKIM asks whether a message carries a signature that can be verified against a public key published in DNS. DMARC asks whether an authenticated identity matches the domain in the visible From address—and lets the domain owner publish a policy and receive reports.
SPF: is this sender authorized?
Sender Policy Framework (SPF) is a DNS-published policy that identifies systems authorized to send mail for a domain. A receiver evaluates SPF against a sending identity, such as the SMTP envelope domain; that identity is not necessarily the address shown in the message’s From field. Consequently, SPF can pass without authenticating the visible From domain in the way a reader might assume. See the SPF specification, RFC 7208.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDKIM: can the message’s signature be verified?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to a message. The receiving service can retrieve the corresponding public key from DNS and use it to verify the signature. A valid DKIM signature does not, on its own, prove that the signing domain matches the visible From domain; DMARC evaluates that relationship. The IETF describes email authentication in internationalized mail in RFC 8616.
#1 Best Overall
DMARC: does an authenticated identity align with From?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks whether at least one authenticated SPF or DKIM identifier aligns with the domain in the RFC 5322 From header. It also allows a domain owner to publish a handling policy and receive aggregate reports about authentication results. In the current DMARC specification, RFC 9989, relaxed alignment permits matching organizational domains, while strict alignment requires the domains to be identical.
Authentication and alignment are different checks
A message can pass SPF or DKIM authentication and still fail DMARC if the authenticated domain does not align with the domain in From. For DMARC to pass, at least one of the two paths must both authenticate and align: SPF with its evaluated sending identity, or DKIM with its signing domain. Configuring both to align is preferable where your sending setup allows it, but DMARC’s pass condition is at least one aligned path.
Authentication is not a guarantee that a message is legitimate, reaches the inbox, or avoids spam. Gmail says authentication helps protect domains and can reduce the chance of rejection or spam placement, but delivery also depends on other requirements and how the receiver handles a message.
Does Gmail require SPF, DKIM and DMARC?
Google’s Gmail sender guidance says all senders need SPF or DKIM. Senders who send more than 5,000 messages per day to Gmail must use SPF, DKIM and DMARC; for this bulk-sender requirement, Google says a DMARC policy of p=none is permitted. These are Gmail requirements, not a universal rule for every receiving service. Google recommends that all senders set up all three standards. Its guidelines state that the requirements began February 1, 2024; consult the live Gmail sender guidelines because provider rules can change.
For direct mail to personal Gmail accounts, Google says a bulk sender’s From organizational domain must align with either SPF or DKIM to meet its alignment requirement. Google recommends aligning both. Its sender FAQ also discusses indirect mail, where forwarding or mailing lists can complicate authentication results.
Set up the records in a safe order
There is no universal SPF, DKIM or DMARC record that is correct for every domain. Your records depend on all the systems that send mail using the domain and on each provider’s instructions. Obtain the exact record values from your mail providers and DNS host rather than copying a generic example.
- Inventory legitimate mail sources. List every service that sends using your domain, including business mail, application notifications and mailing services. Identify which From domains those messages use.
- Configure SPF for the sending services. Follow the providers’ instructions for authorizing their sending systems in the domain’s SPF policy. Check that the evaluated SPF identity can align with the visible From domain for the mail you intend to authenticate.
- Enable DKIM signing. Configure each provider that sends domain mail to sign messages, then publish the public key in DNS using the provider’s supplied record. Confirm that the signing domain can align with the visible From domain.
- Publish a DMARC policy and arrange reporting. Use the DMARC record instructions for your domain and choose an aggregate-report destination that your organization can monitor. Google’s stated bulk-sender threshold permits
p=none; the right policy for other circumstances depends on your goals and observed legitimate traffic. - Review results before tightening enforcement. Analyze aggregate reports, identify legitimate services that fail authentication or alignment, and correct their configuration. Only strengthen the policy after you understand the traffic using your domain.
RFC 9989 describes full participation in DMARC as including aligned SPF and DKIM, collecting and analyzing aggregate reports, and publishing the policy record. That makes reporting part of an ongoing configuration process—not merely a record to add and forget.
Why DMARC can fail even when SPF or DKIM passes
- The authenticated domain does not align with From. SPF may authenticate an envelope domain or DKIM may authenticate a signing domain that differs from the visible From domain. Check both identities and the configured relaxed or strict alignment mode.
- A legitimate sender was left out of the setup. A service added later, or one overlooked during the initial inventory, may not be configured with the necessary SPF authorization or DKIM signing. Use provider-specific instructions and check report data for the affected traffic.
- Forwarding or mailing-list handling changes the result. Indirect mail can affect SPF and alignment. Google identifies it as a special case in its sender FAQ; examine affected messages and reporting rather than assuming every failure is a forged message.
- The policy was tightened before legitimate traffic was understood. A stronger handling policy can affect legitimate mail that has not been correctly authenticated or aligned. Review aggregate reports and resolve those sources before increasing enforcement.
What to check when choosing or configuring a mail provider
Use these questions to evaluate any service that sends email for your domain:
Quick Recap
- Does it support the kinds of messages you need to send?
- Can it authenticate with SPF and DKIM in a way that aligns with your visible From domain?
- Does it provide clear, provider-specific DNS setup instructions?
- Can your team collect and analyze DMARC aggregate reports to identify misconfigured legitimate traffic?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
