Home / Blog / SPF, DKIM & DMARC explained

SPF, DKIM and DMARC explained

By Andrej Uzusienis · July 24, 2026 · 8 min read

If your emails land in spam or get rejected outright, the first thing to check is authentication. Mailbox providers like Gmail and Outlook now require it, and three records do the heavy lifting: SPF, DKIM and DMARC. Here is what each one does, in plain English.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain. When a message arrives, the receiver checks whether it came from an approved server. If a spammer sends from somewhere not on your list, SPF fails. An SPF record looks like v=spf1 include:_spf.google.com ~all and lives as a TXT record on your domain.

DKIM: proof the message was not tampered with

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message using a private key. The matching public key sits in your DNS. The receiver verifies the signature, proving the email really came from your domain and was not altered in transit. Unlike SPF, DKIM survives forwarding, which makes it more reliable.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication) tells receivers what to do when SPF or DKIM fail: nothing (p=none), send to spam (p=quarantine), or reject (p=reject). It also sends you reports so you can see who is sending on your behalf. DMARC is what actually stops spoofing of your domain.

How they work together

SPF says which servers may send.
DKIM proves the message is genuine and unaltered.
DMARC decides what happens when the checks fail, and reports back.

Check your domain's SPF, DKIM and DMARC

Mailcheq's free tools check your SPF and DMARC records instantly and flag common mistakes.

Verify an address →

Setting them up correctly

Publish a single SPF record that includes every service that sends for you (never more than one SPF record per domain).
Enable DKIM in your email provider and add the published key to DNS.
Start DMARC at p=none with a reporting address, review the reports for a week or two, then tighten to quarantine and finally reject.

Get these three right and you remove the single biggest technical reason legitimate email gets filtered. Before a big send, it is also worth verifying your list with a tool like Mailcheq so authentication is not wasted on dead addresses.

Spotted an error in this article? Email hello@mailcheq.com and we will fix it.