SPF, DKIM, and DMARC Explained Simply (No Jargon)

Every email you send gets checked three times before it reaches an inbox, and you never see it happen. If any of those checks fail, the email either lands in spam or gets rejected outright.

Those three checks are SPF, DKIM, and DMARC. They sound technical, but the idea behind each one is genuinely simple once you see it laid out.

Here's what this guide covers:

The quick answer: what each one does, in one line
A simple analogy that makes the whole thing click
What SPF, DKIM, and DMARC each actually check
Whether you need all three, or just one
The most common setup mistakes

Let's make this simple.

Stop landing in spam.Book a deliverability audit and get a clear recovery plan.Book an audit

The Quick Answer

Record	What it does
SPF	Lists which servers are allowed to send email as you
DKIM	Proves the email wasn't altered on its way to the inbox
DMARC	Decides what happens if SPF or DKIM fails

That's the whole idea. Everything else is detail.

The Simple Analogy: Think of Email Like a Letter

Imagine every email is a physical letter.

SPF is the approved list of carriers. It tells the post office which delivery companies are allowed to drop off mail on your behalf. A letter from a carrier not on the list looks suspicious.
DKIM is a wax seal. It proves the letter wasn't opened or altered after you sent it. If the seal is broken or missing, something's wrong.
DMARC is the instruction left with the mail room. It says what to do if a letter shows up with no valid seal, from a carrier that isn't approved, or with the wrong name on the envelope.

That last part matters more than it sounds. DMARC also checks that the name on the envelope matches the name inside the letter. In email terms, it checks that the domain SPF or DKIM just approved actually matches the domain your recipient sees in the "From" field. This is called alignment, and it's the piece most guides skip over. Without it, a message could technically pass SPF or DKIM while still claiming to be from someone else.

What Is SPF?

SPF (Sender Policy Framework) is a short line of text in your domain's DNS settings that lists every server and tool allowed to send email as you.

v=spf1 include:_spf.google.com ~all

This example authorizes Google Workspace to send on the domain's behalf. If you use other tools too, like a CRM or a cold email platform, each one needs to be added to this same record, not a separate one. A domain can only have one SPF record, so every sending tool has to be included in it together.

⚠️ The most common SPF mistake is forgetting to add a new tool when you start using it. If you add a new sending platform and skip this step, its emails can fail authentication immediately.

What Is DKIM?

DKIM (DomainKeys Identified Mail) attaches a unique digital signature to every email you send. The receiving server checks that signature against your domain's DNS records to confirm the message wasn't tampered with in transit.

Unlike SPF, you don't usually write a DKIM record by hand. Your email provider generates it for you, and you just add it to your DNS settings when prompted. Each sending tool typically needs its own DKIM signature, published under its own unique address in your DNS (your provider will give you this when you set it up).

What Is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) sits on top of SPF and DKIM. It doesn't do its own check exactly, it looks at the SPF and DKIM results, confirms they align with your visible "From" domain, and then tells the receiving server what to do if something doesn't match.

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com

The p= part is your policy, and it's the setting people get wrong most often:

Policy	What it means
p=none	Monitor only. Failed emails still get delivered.
p=quarantine	Failed emails get sent to spam.
p=reject	Failed emails get blocked entirely.

A lot of domains get stuck on p=none forever, which means DMARC is watching but doing nothing to actually stop a spoofed email. The rua= part is a bonus: it has reports sent to an inbox of your choice, showing you who's sending email using your domain, which is a handy way to catch problems early.

💡 Pro tip: moving your policy to quarantine or reject doesn't just block spoofed email. It's also a signal to inbox providers that you take authentication seriously, which can work in your favor more broadly, not just during a DMARC check.

🎯 Getting this trio right across every domain you send from is exactly what we check first during an email deliverability audit.

Why This Matters for Cold Email and Email Marketing

The technical setup is the same either way, but how much it matters, and how quickly a gap gets punished, depends on what you're sending.

For cold email, the margin for error is small. Your recipients never opted in, so inbox providers are already watching your domain more closely from the very first message. A missing or broken record doesn't just hurt you a little, it can mean your emails get filtered or blocked almost immediately, especially once you're sending any real volume. This is also why, if you're sending cold email from multiple domains, every single one needs this set up correctly, not just your primary one.

For email marketing, the stakes feel lower since your list opted in, but the setup still matters just as much technically. Without DMARC in particular, nothing stops someone else from sending phishing emails that appear to come from your domain, which quietly damages the trust and reputation your real newsletters depend on. Authentication also affects whether your campaigns land in the primary inbox or the promotions tab, which has a direct impact on open rates.

In both cases, the three records are doing the same job: proving the email is really from you. Cold email just has far less room to recover if that proof is missing.

Do You Need All Three, or Just One?

Technically, you can set up just one. In practice, each one covers a gap the others leave open.

Setup	What breaks
SPF only	Breaks when an email gets forwarded, since the forwarding server isn't on your approved list
DKIM only	A message can have a valid signature from the wrong domain, with nothing checking where it was actually sent from
SPF + DKIM, no DMARC	Both checks can run, but nothing confirms they match your visible domain, and there's no policy telling receivers what to do if they don't
All three together	Each gap gets covered by one of the other two

If you're only going to do one thing, set up all three. They're designed to work as a set, not as alternatives to each other.

Where Each Record Goes

Record	Where it lives
SPF	A TXT record on your root domain
DKIM	A TXT record on a selector subdomain your provider gives you
DMARC	A TXT record at _dmarc.yourdomain.com

If you're sending cold email from multiple domains, every single one needs its own SPF, DKIM, and DMARC setup. This is one of the most common gaps we see, especially when someone scales up to several sending domains and forgets to repeat the setup on each one.

How to Check If Yours Are Set Up Correctly

Free DNS lookup tools, like MXToolbox, let you check your SPF, DKIM, and DMARC records against your domain in a few seconds. They'll tell you whether each record exists, whether it's formatted correctly, and whether there are conflicts, like two SPF records on the same domain, which breaks both.

Common Mistakes

Multiple SPF records on one domain. Only one is allowed. Having two breaks authentication entirely, not just the newer one.
Forgetting to add every sending tool to SPF. Each tool you use to send email needs to be listed, not just your main mailbox.
Leaving DMARC at p=none indefinitely. This monitors but never actually stops a spoofed email from reaching someone's inbox.
Setting up records once and never checking again. Adding a new tool or switching providers can silently break a record that used to work fine.

Conclusion

SPF, DKIM, and DMARC aren't three separate hurdles to clear. They're one system: SPF says who's allowed to send, DKIM proves nothing was changed, and DMARC decides what happens if either one fails.

If you're not sure...	Here's the short version
What SPF does	Approves which servers can send as you
What DKIM does	Proves the message wasn't altered
What DMARC does	Sets the policy for what happens if something fails
Whether you need all three	Yes, each one covers a gap the others leave open

If you're not sure your setup is actually correct, that uncertainty is exactly what an audit resolves. Our case studies show what fixing this looked like for senders in the same spot.

Stop landing in spam.Book a deliverability audit and get a clear recovery plan.Book an audit

FAQ

Do I need DMARC if I already have SPF and DKIM set up?

Yes. SPF and DKIM run the checks, but without DMARC, nothing confirms they match your visible domain or tells receivers what to do if something fails. It's the piece that actually enforces the other two.

What happens if I don't set any of these up at all?

Inbox providers have no way to confirm your emails are really from you, so they treat your domain with more suspicion. That usually means more of your mail lands in spam, and in some cases gets rejected outright.

Can I check my SPF, DKIM, and DMARC setup myself for free?

Yes. Free DNS lookup tools can check all three in seconds and flag common issues, like conflicting SPF records. For a deeper check tied to your actual sending reputation, that's covered in a full deliverability audit.

Do Gmail and Yahoo require all three now?

Since 2024, Gmail and Yahoo have required proper authentication from anyone sending meaningful volume. SPF and DKIM are the baseline, and a DMARC record is expected as well.

Which DMARC policy should I use, p=none, quarantine, or reject?

Start with p=none to monitor without disrupting your mail flow, then move to quarantine once you've confirmed everything legitimate is passing. Reject is the strongest setting, but it's worth working up to it rather than starting there.

Loading…