DomailfixSPF, DKIM and DMARC explained simply
If your emails land in spam, or bounce with "message rejected", the first thing to check is email authentication. SPF, DKIM and DMARC are three DNS records that prove your emails really come from you. Gmail, Yahoo and Microsoft now expect them from anyone who sends a lot of email.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a list of the servers and services allowed to send email for your domain. It is one TXT record on your domain.
Example for a company using Google Workspace and a newsletter tool:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
- include: adds a service's servers to your list.
- ~all at the end means "anything else is suspicious". -all means "reject anything else".
Rules to remember:
- Have only one SPF record per domain. Two records break SPF.
- Keep it under 10 lookups (each include counts). Too many and SPF fails.
- Add every service that sends as you: your mailbox provider, CRM, newsletter and helpdesk tools.
DKIM: a signature on every email
DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The receiving server checks the signature against a public key you publish in DNS. If the email was changed on the way, or was not sent by you, the check fails.
You don't write DKIM records by hand. Your email provider (Google Workspace, Microsoft 365, Zoho Mail and others) gives you a record to add, usually at an address like google._domainkey.yourdomain.com. Turn DKIM signing on in the provider's admin panel after adding it.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM together and tells receiving servers what to do with email that fails them. It also sends you reports, so you can see who is sending as your domain.
A safe first record, added as a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- p=none only monitors. Start here.
- p=quarantine sends failing email to spam.
- p=reject blocks failing email completely.
Read the reports for a few weeks, fix any service that fails, then move to quarantine and later reject.
Why it matters now
Since 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM and a DMARC record, and to keep spam complaints low. Without them, your emails are more likely to go to spam or be rejected.
Check your domain free
Use the free Domailfix tools to check your records in seconds:
Authentication proves who you are. It does not fix a bad list. Verify your addresses too, so you don't send to mailboxes that no longer exist. See why emails bounce.
Questions and answers
Do I need all three: SPF, DKIM and DMARC?
Yes. SPF and DKIM prove the email is yours, and DMARC tells receivers what to do when they fail. Gmail and Yahoo expect all three from bulk senders.
Will DMARC block my own emails?
Not with p=none, which only monitors. Move to quarantine or reject only after the reports show that all your sending services pass.