SPF, DKIM, and DMARC Explained (Without the Jargon)

Category: Email Concepts

PNWritten by Priya Nair, Security & Privacy Editor · Last reviewed Aug 2026

Quick answer: SPF lists who's allowed to send as your domain, DKIM proves a message wasn't altered in transit, and DMARC tells receiving servers what to do if either check fails.

If you've ever seen your own emails land in spam, or you're setting up a custom domain to send from, you'll run into these three acronyms. Here's what each one actually does.

SPF — "which servers are allowed to send as me"

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email claiming to be from your domain. When a receiving server gets a message "from" yourdomain.com, it checks whether the sending server is on your approved list.

Think of it as a guest list at the door — only servers on the list get to say they're from your domain.

DKIM — "proof the message wasn't tampered with"

DKIM (DomainKeys Identified Mail) attaches a digital signature to outgoing messages, generated using a private key only your mail server knows. The receiving server checks that signature against a public key published in your DNS. If it matches, the message wasn't altered in transit and genuinely came from a server holding your private key.

DMARC — "what to do if a message fails the checks"

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together and tells receiving servers what to do with a message that fails both: reject it, quarantine it (send to spam), or let it through anyway. It can also send you reports showing who's sending mail using your domain — useful for catching impersonation.

Why this matters for deliverability

If you send email "as" your own domain (through a business tool, a contact form, or a custom SMTP setup) without SPF, DKIM, and DMARC configured, receiving providers like Gmail and Outlook are increasingly likely to filter that mail as spam or reject it outright — this has gotten stricter industry-wide, not looser.

Check your own domain right now

Rather than guessing whether these are set up correctly, run a live check: SPF Checker, DKIM Checker, DMARC Checker, and MX Record Checker — free, no signup, real DNS lookups. If you're troubleshooting a specific message rather than your domain's setup, our Email Header Analyzer can show you the actual SPF/DKIM/DMARC results for that message.

Setting these up

All three are configured as DNS records (TXT records, specifically) through wherever your domain's DNS is managed — your domain registrar or hosting provider. The exact record values are usually provided by whatever service is sending the mail (your hosting provider, an email marketing tool, or Google Workspace/Microsoft 365 if you use one of those).

Getting these records wrong can block legitimate mail entirely, not just improve deliverability. If you're not confident editing DNS, ask your host or IT support to do it, or have them review it before publishing.