Start free

Developer documentation

SPF, DKIM and DMARC explained for developers

What SPF, DKIM and DMARC each prove, how alignment works, what the records look like and a safe order for rolling out DMARC.

SPF, DKIM and DMARC are DNS records that let receiving servers check that a message really came from your domain. Mailbox providers use them to decide whether mail reaches the inbox, the spam folder or nowhere.

SPF: which servers may send

An SPF record is a TXT record that lists the servers allowed to send for a domain. The receiver compares the connecting server with that list. SPF checks the envelope sender (the return path), not the address people see in the From line.

example.com.  TXT  "v=spf1 include:_spf.provider.example ~all"

An SPF check may follow at most 10 DNS lookups. Each include counts, and a record over the limit fails. Use the SPF checker to see how many lookups yours uses.

DKIM: a signature on the message

With DKIM, your sending service signs each message with a private key. You publish the matching public key in DNS under a selector, such as selector._domainkey.example.com. The receiver fetches the key and verifies the signature, which also proves the signed headers and body were not changed in transit.

DMARC: what to do when checks fail

DMARC ties the other two to the visible From domain. A message passes when SPF or DKIM passes and aligns, meaning the domain that passed matches the From domain. The record also tells receivers what to do with failures and where to send reports.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

A safe rollout order

  1. Publish the SPF and DKIM records your sending service gives you and confirm they verify. The domain setup guide covers common DNS problems.
  2. Add DMARC with p=none and a reporting address. This monitors without affecting delivery.
  3. Read the reports for a few weeks and fix every legitimate sender that fails alignment: marketing tools, support desks, internal systems.
  4. Move to p=quarantine, then p=reject once nothing legitimate fails.

Build a monitoring record with the DMARC checker and generator. Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024, and the same records help smaller senders reach the inbox.

Next steps