Three shield icons labeled SPF DKIM DMARC protecting email domain

Domain Security

SPF, DKIM, and DMARC Explained: How to Stop Your Email Going to Spam

Domain 360 Team

·July 4, 2026·8 min read

Before SPF, DKIM, and DMARC existed, anyone could send an email claiming to be from any domain. Phishing emails routinely arrived appearing to come from banks, employers, and government agencies, with nothing in the email itself to indicate they were fraudulent.

Quick answer: Three DNS records determine whether your email is trusted or treated as spam. Most businesses have at least one of them wrong. Here is what SPF, DKIM, and DMARC actually do — and how to set them up correctly.

These three records solve that problem. They give email receivers the tools to verify that an email genuinely came from who it claims to come from, and they give domain owners the ability to enforce what happens when verification fails.

SPF: Who Is Allowed to Send Email as Your Domain?

SPF (Sender Policy Framework) is a TXT record that lists which mail servers are authorized to send email from your domain. When a mail server receives an email claiming to be from [email protected], it checks whether the sending server's IP address is in your SPF record.

SPF record structure: v=spf1 [mechanisms] [qualifier]all

The mechanisms list your authorized senders: include:_spf.google.com allows Google Workspace include:spf.protection.outlook.com allows Microsoft 365 ip4:203.0.113.10 allows a specific IP address

The qualifier before all defines what happens with senders not in the list: ~all (softfail): treat as suspicious, usually delivers to spam -all (hardfail): reject outright +all: accept everything (never use this)

For most businesses: v=spf1 include:_spf.google.com ~all is a correct starting point for Google Workspace. Add other includes for any other services you send email through (marketing platforms, CRM systems, etc.).

One SPF record per domain. If you have multiple services, merge them into one record with multiple includes. Two SPF records cause failures.

DKIM: How Does It Prove the Email Wasn't Tampered With?

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing emails. The sending mail server signs each email with a private key. The corresponding public key is published in a DNS TXT record. Receiving servers fetch the public key and verify the signature — if it matches, the email has not been altered in transit.

DKIM is configured in your email provider's admin console, not directly in DNS. You enable it in Google Workspace admin, Microsoft 365 admin, or your email host, and the system generates a public/private key pair. You then add the public key as a TXT record in your DNS under a specific selector subdomain — typically something like google._domainkey.yourdomain.com.

The specific record values are provided by your email provider during setup. Copy them exactly.

DMARC: How Do Policy and Reporting Work?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a policy record that: 1. Tells receiving servers what to do when SPF and/or DKIM fail 2. Requests that receivers send reports of failures back to you

A basic DMARC record: v=DMARC1; p=none; rua=mailto:[email protected]

The p= value is the policy: none means monitor only — receive reports but take no action on failures. quarantine means failed emails go to spam. reject means failed emails are not delivered at all.

Start with p=none to gather data without risking legitimate email being blocked. Review the reports (or use a DMARC reporting service to parse them) to identify legitimate senders that might be missing from your SPF record. Once you are confident the configuration is complete, move to p=quarantine and eventually p=reject.

How Do You Check Your Current Setup?

From any terminal: nslookup -type=txt yourdomain.com

Look for a line starting with v=spf1 — that is your SPF record. If none exists, SPF is not configured.

For DKIM (replace google with your provider selector): nslookup -type=txt google._domainkey.yourdomain.com

For DMARC: nslookup -type=txt _dmarc.yourdomain.com

MXToolbox.com provides a friendlier web interface that checks all three simultaneously and explains any problems found.

How Does This Connect to Domain Health?

SPF, DKIM, and DMARC records live in your domain DNS — meaning they are only valid as long as your domain is registered and DNS is resolving. An expired domain loses these records along with everything else, and email sent during a domain lapse cannot be authenticated. Our guide on what happens to email when a domain expires covers the specific failure modes.

Maintaining these records means maintaining the domain. A domain management dashboard with automatic expiry alerts is the unglamorous but necessary foundation for everything in email security.

Quick Answers

What are SPF, DKIM, and DMARC?

They are three DNS records that work together to authenticate email. SPF specifies which mail servers are allowed to send email claiming to be from your domain. DKIM adds a cryptographic signature to each email that receivers can verify has not been tampered with. DMARC is a policy record that tells receivers what to do with email that fails SPF or DKIM checks, and sends reports back to the domain owner.

Do I need all three?

SPF and DKIM are now effectively required for email deliverability to major providers. Google and Microsoft reject or spam-filter email from domains missing authentication records. DMARC is strongly recommended on top — without it, authentication failures generate no visibility or policy enforcement. All three together provide complete protection and visibility.

How do I check if SPF is set up correctly?

Run nslookup -type=txt yourdomain.com and look for a record starting with v=spf1. You can also use MXToolbox SPF check. A valid SPF record will show which sending services are authorized. If no SPF record exists, any server can send email claiming to be from your domain.

What should my SPF record look like?

It depends on which services you send email from. A basic Google Workspace SPF record looks like: v=spf1 include:_spf.google.com ~all. If you also send through Mailchimp, add its include. The ~all at the end means "treat unlisted senders as suspicious" — use -all (hard fail) once you are confident the record is complete.

How do I know if my email is being rejected due to SPF or DKIM failure?

Check the email headers of a test message received at Gmail: click the three dots, Show original. Look for lines saying spf=pass, dkim=pass, and dmarc=pass. Any failure here indicates a misconfiguration. Senders may also receive bounce messages citing authentication failures, depending on the receiver SPF/DMARC policy.

Never lose a domain again

Track every domain you own in one dashboard. Free for up to 15 domains.