Deliverability·Updated 2025-07-01·9 min read

SPF vs DKIM vs DMARC Explained

Clear, practical explanation of SPF, DKIM, and DMARC — what each record does, how they work together, and how to set them up correctly for cold email.

Quick Answer

SPF proves which servers can send email for your domain. DKIM proves the email was not altered in transit. DMARC tells receiving servers what to do when SPF or DKIM checks fail. You need all three.

What Each Record Does
SPF (Sender Policy Framework)
DKIM (DomainKeys Identified Mail)
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
How SPF, DKIM, and DMARC Work Together
Setup Walkthrough
How to Verify Your Records

Introduction

SPF, DKIM, and DMARC are three DNS records that work together to prove your email is legitimate. They are not optional for cold email — they are the minimum technical foundation for landing in inboxes.

This guide explains what each one does in plain language, how they work together, and exactly how to set them up on your sending domain.

Who This Guide Is For

• Anyone setting up a sending domain for cold email
• People who keep seeing references to SPF, DKIM, and DMARC but are not sure what they actually do
• Teams troubleshooting deliverability issues related to authentication

Key Takeaways

1. SPF, DKIM, and DMARC are three separate records that work as a team
2. SPF authorizes sending servers; DKIM signs emails with a cryptographic key
3. DMARC combines both checks and defines a failure policy
4. All three must be correctly configured for optimal deliverability
5. Start DMARC in monitoring mode before enforcing

What Each Record Does

Record	Purpose	Analogy
SPF	Lists servers authorized to send for your domain	A list of approved phone numbers
DKIM	Adds a cryptographic signature to prove authenticity	A wax seal on a letter
DMARC	Tells servers what to do when SPF/DKIM fail	The instructions for what to do if the seal is broken

SPF (Sender Policy Framework)

SPF is a DNS TXT record that lists the IP addresses or mail servers authorized to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks the SPF record to verify the sending server is on the list.

How SPF Works

You publish an SPF record listing your authorized sending servers
When you send an email, the receiving server checks the sending IP against your SPF record
If the IP is on the list, SPF passes. If not, SPF fails.

SPF Record Example

A typical SPF record looks like this: v=spf1 include:_spf.google.com ~all. This says: 'Google's mail servers are authorized to send email for this domain.' The ~all at the end is a soft fail for unauthorized servers.

ℹ️ Info

SPF has a limit of 10 DNS lookups. If you use multiple services (Google, a cold email tool, a CRM), each include counts as a lookup. Keep your SPF record lean.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to every email you send. This signature is generated using a private key that only you control. Receiving servers use the public key (published in your DNS) to verify the signature, proving the email came from you and was not altered in transit.

How DKIM Works

Your email provider generates a DKIM key pair (private + public)
The private key signs each outgoing email
The public key is published as a DNS TXT record
Receiving servers look up the public key and verify the signature

DKIM Record Example

A DKIM record is published at a specific subdomain, like google._domainkey.yourdomain.com. It contains the public key: v=DKIM1; k=rsa; p=MIGfMA0GCS... (a long base64 string). Your email provider generates this for you.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when either one fails. Without DMARC, receiving servers make their own decisions about how to handle authentication failures.

DMARC Policies

Policy	What It Does	When to Use
p=none	Monitor only — do not take action on failures	Start here, always
p=quarantine	Send failing emails to spam	After monitoring confirms SPF/DKIM pass rates
p=reject	Reject failing emails entirely	Only after extensive monitoring and confidence

DMARC also provides reporting. The rua tag tells receiving servers where to send aggregate reports about authentication results. These reports tell you how often SPF and DKIM pass or fail.

⚠️ Warning

Never start with p=reject. If your SPF or DKIM is misconfigured, you will block all your email. Start with p=none, monitor for 2–4 weeks, then gradually increase to p=quarantine and eventually p=reject.

How SPF, DKIM, and DMARC Work Together

You send an email from your sending domain
Receiving server checks SPF: Is the sending server on the authorized list?
Receiving server checks DKIM: Is the email signature valid?
Receiving server evaluates DMARC: Did both SPF and DKIM pass? If not, what does the DMARC policy say to do?
Email is placed in inbox, spam, or rejected based on the combined results

For best deliverability, you want both SPF and DKIM to pass and your DMARC policy to be properly configured. Having both pass (called alignment) gives receiving servers the highest confidence that your email is legitimate.

Setup Walkthrough

For Google Workspace Users

Log in to your domain registrar's DNS management console
Add the SPF TXT record as provided by Google Workspace admin
Add the DKIM TXT record from Google Admin > Apps > Gmail > Authenticate email
Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
Wait 24–48 hours for DNS propagation
Verify all records using MXToolbox or Google Admin Toolbox

For Microsoft 365 Users

Add the SPF TXT record pointing to Microsoft's servers
DKIM is enabled through the Microsoft 365 Defender portal
Add the DMARC TXT record at _dmarc.yourdomain.com
Wait for DNS propagation and verify

💡 Tip

Most email providers have step-by-step DNS setup guides. Follow your provider's documentation for exact record values — do not copy values from generic examples.

How to Verify Your Records

Use MXToolbox DNS Lookup to check each record individually
Use Google Admin Toolbox Check MX to verify all records at once
Send a test email to mail-tester.com and check the authentication results
Check Google Postmaster Tools for ongoing SPF/DKIM/DMARC performance
Verify records after any DNS change — propagation can take 24–48 hours

Best Practices

✓ Configure all three records: SPF, DKIM, and DMARC
✓ Start DMARC with p=none and monitor before enforcing
✓ Keep your SPF record under 10 DNS lookups
✓ Use your email provider's specific record values, not generic examples
✓ Verify records after setup and after any DNS changes
✓ Monitor DMARC reports regularly to catch issues early

Mistakes to Avoid

✗ Skipping DMARC entirely — many people set up SPF and DKIM but forget DMARC
✗ Starting with p=reject without monitoring first
✗ Exceeding the 10-lookup SPF limit
✗ Publishing DKIM with an incorrect selector
✗ Not verifying records after DNS propagation
✗ Copying record values from blog posts instead of your email provider

Expert Tips

★ DMARC aggregate reports are your best friend for understanding authentication health
★ If SPF fails intermittently, check your DNS lookup count — you may have too many includes
★ DKIM alignment is more reliable than SPF alignment for Gmail deliverability
★ Test your setup at mail-tester.com before starting any cold email campaign

Authentication Checklist

☐ SPF record published and verified
☐ DKIM record published and verified
☐ DMARC record published with p=none
☐ All records pass at MXToolbox
☐ Test email passes at mail-tester.com
☐ DMARC reports configured and being received
☐ No DNS lookup limit issues with SPF

Summary

SPF, DKIM, and DMARC are three complementary authentication records. SPF authorizes sending servers, DKIM signs emails cryptographically, and DMARC defines the policy when either fails.

All three are required for optimal cold email deliverability. The setup process is straightforward: publish TXT records in your DNS, verify they propagate correctly, and monitor results.

Start DMARC in monitoring mode, check your reports, and gradually tighten the policy as you confirm everything is working.

Frequently Asked Questions

Do I need all three records?

Yes. SPF alone is not enough because it can be spoofed without DKIM. DKIM alone does not tell servers what to do on failure. DMARC without SPF and DKIM has nothing to evaluate. You need all three for a complete authentication setup.

How long does DNS propagation take?

Usually 24–48 hours, but it can be faster. Most DNS changes propagate within a few hours. Always wait at least 24 hours before testing.

What is DMARC alignment?

Alignment means the domain in the email's From header matches the domain checked by SPF and/or DKIM. For best deliverability, you want both SPF and DKIM to pass and align with your From domain.

Can I use multiple email providers on one domain?

Yes, but you need to be careful with SPF. Each provider requires its own include in the SPF record, and you are limited to 10 DNS lookups. For DKIM, each provider uses its own selector, so there is no conflict.