What Are SPF, DKIM and DMARC?

SPF, DKIM and DMARC are three email checks that help email services confirm whether a message comes from the domain it claims to. A domain is the part of an email address after the @ sign, such as example.com, and these checks make it harder for someone else to send messages pretending to come from that domain.

Your email service usually performs these checks in the background. You might come across their names when an email is marked as suspicious or when setting up email for a domain you own.

What Are DNS Records?

DNS stands for Domain Name System. It lets internet services look up public settings for a domain, including information about its email. Those settings are stored as DNS records.

You can think of DNS records as instructions that other services can find when they need to deal with your domain. Some tell services where to deliver email, while others help check whether a message is authorised. SPF, DKIM and DMARC are published using a type of DNS record called a TXT record, which holds text.

The examples below use example.com to show what these records look like. They are illustrations, not settings to copy.

What Is an SPF Record?

SPF stands for Sender Policy Framework. An SPF record lists which mail servers are authorised to send email on behalf of a domain. A mail server is a computer system that sends, receives or passes along messages as part of how email works.

When an email arrives, the receiving service checks whether the server that sent it is authorised by the relevant SPF record. If the server is on the authorised list, the SPF check can pass. If it is not, the check can fail.

SPF does not directly check the address that you see on the From line of an email. It normally checks a separate sending address used between mail servers, which is why an SPF pass alone cannot prove that the visible sender address is genuine.

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

This example authorises a server identified by the sample internet address 192.0.2.10 and says that other servers are not authorised. When you add a record like this at a domain provider, you usually enter only the part in quotation marks.

What Is DKIM?

DKIM stands for DomainKeys Identified Mail. When a sending service uses DKIM, it adds a digital signature to an outgoing email. A digital signature is a special code created from parts of a message using a secret key held by the sending service.

The receiving service checks that signature using a public key, which is a matching key that anyone can look up in the domain’s DNS records. If the check passes, it helps confirm which domain signed the email and that the parts covered by the signature have not changed on the way.

DKIM does not necessarily cover every part of the message. It also does not, by itself, prove that the signing domain matches the domain shown in the visible From address.

s1._domainkey.example.com. IN TXT "v=DKIM1; k=ed25519; p=11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="

This example publishes a public key for checking a DKIM signature, with k=ed25519 identifying the type of key.

What Is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It brings SPF and DKIM together by checking whether the domain in the visible From address matches the domain that passed SPF or DKIM. Under the usual rules, a related subdomain, such as mail.example.com, can also count as a match.

A message needs at least one successful SPF or DKIM check with a matching domain to pass DMARC. This matters because a message could pass SPF for one domain while claiming to come from a different domain in its From address.

A DMARC record also states how the domain owner would like receiving services to handle emails that fail DMARC. It offers three policy choices: none asks for no special action because of DMARC, quarantine asks for the message to be treated as suspicious, often by sending it to the spam folder, and reject asks the receiving service to refuse it. The receiving service still makes the final decision.

DMARC can also specify an address for reports about email claiming to come from the domain. Those reports can help the owner identify unauthorised use or problems with legitimate messages. Receiving services are not required to send every requested report.

_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:reports@example.com"

This example asks receiving services to treat failed messages as suspicious and send summary reports to reports@example.com.

How Do SPF, DKIM and DMARC Work Together?

SPF checks the sending server, DKIM checks a digital signature, and DMARC connects those results to the domain shown in the From address. They perform different jobs, but together they give receiving email services a stronger basis for deciding whether a domain is being used with permission.

Imagine someone sends an email showing From: hello@example.com from a server that example.com has not authorised. If there is also no valid DKIM signature from a matching domain, the email cannot pass DMARC. The receiving service can then consider the domain’s published policy when deciding what to do with it.

This helps reduce email spoofing, where someone makes a message appear to come from another domain. It can also block some fake messages used in phishing, where someone tries to trick you into revealing information or taking an unsafe action.

What Are MX Records?

MX stands for Mail Exchange. MX records tell other email services which mail servers receive messages for a domain. When someone sends an email to person@example.com, the sending service can look up example.com’s MX records to find where that message should go.

MX records are not a security check and do not verify that an email’s sender is genuine. They sit alongside SPF, DKIM and DMARC in DNS because they handle a different part of the email system. When you use email with your own domain, these records are often set up around the same time.

Why Do These Checks Matter, and Where Can You See the Results?

For most people using Gmail, Outlook or another email service, SPF, DKIM and DMARC operate without anything to configure. They can reduce the number of messages that falsely claim to be from a familiar domain. Email services also use other checks when deciding what reaches an inbox.

If you send emails from your own domain, missing or incorrect authentication records can cause a receiving service to send messages to spam or reject them. A rejection may produce a bounced email notice. This does not mean every email without all three records will fail to arrive.

You can sometimes see the check results in an email’s full header, which contains technical details about the message. A line called Authentication-Results may show results such as spf=pass, dkim=pass and dmarc=pass, or show that a check failed. These are results recorded by the service that examined the message.

Even if all three checks pass, that does not mean an email is safe. Someone can send a harmful message from a domain they own and authenticate it correctly. Checking whether an email is real also means considering what the message says and what it asks you to do.