SPF, DKIM and DMARC Explained Simply (and How to Set Them Up)

What SPF, DKIM and DMARC are, why Gmail and Yahoo require them, and step-by-step instructions to add them to your domain’s DNS.

In short: SPF lists the servers allowed to send for your domain, DKIM signs each email so it can’t be forged or altered, and DMARC tells mailbox providers what to do when those checks fail. Gmail and Yahoo now require all three for bulk senders. Setting them up is a one-time copy-and-paste job in your domain’s DNS.

SPF, DKIM and DMARC are three DNS records that prove your emails really come from you. Without them, Gmail, Yahoo and Outlook have no way to tell your newsletter apart from a scammer pretending to be you — so they treat it with suspicion. With them, your emails are trusted, and nobody can easily impersonate your domain.

The 30-second version

SPF says which servers are allowed to send email for your domain.
DKIM adds a digital signature to each email, proving it wasn't changed and really came from your domain.
DMARC tells mailbox providers what to do if an email fails those checks — and sends you reports.

Think of it as an ID card (SPF), a tamper-proof seal (DKIM) and instructions for the security guard (DMARC).

SPF (Sender Policy Framework)

SPF is a TXT record on your domain listing the services allowed to send as you. It looks like:

v=spf1 include:_spf.google.com include:spf.yourplatform.com ~all

Rules to know:

One SPF record per domain. If you use several services, combine them into a single record with multiple "include" parts.
Keep it under 10 lookups. Each "include" counts; too many breaks SPF.
End with ~all (soft fail) or -all (hard fail).

DKIM (DomainKeys Identified Mail)

Your email platform signs every message with a private key. You publish the matching public key in DNS (usually a TXT or CNAME record at a name like selector._domainkey.yourdomain.com). Receiving servers check the signature against it.

DKIM is especially important because it survives forwarding, and it's what most mailbox providers rely on for your domain's reputation.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC is a TXT record at _dmarc.yourdomain.com. A good starting record:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none — monitor only; nothing is blocked. Start here.
p=quarantine — failing email goes to spam.
p=reject — failing email is refused.

DMARC passes when SPF or DKIM passes and matches (aligns with) the domain in your From address. Once your reports show all your legitimate email passing, you can tighten the policy to quarantine and then reject, which stops others from spoofing your domain.

Why it matters now

Since 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC in place, and all senders to authenticate with at least one of them. Unauthenticated marketing email is increasingly rejected outright. See Gmail and Yahoo's requirements.

How to set them up (step by step)

In your email platform, add your sending domain. It will show the exact records you need.
Log in to your domain registrar or DNS host (GoDaddy, Namecheap, Cloudflare, etc.) and open DNS settings.
Add each record exactly as shown: type (TXT or CNAME), host/name, and value.
Merge SPF with any existing SPF record instead of adding a second one.
Wait — DNS changes usually appear within minutes, sometimes up to 48 hours.
Verify in your platform, then send yourself a test and check "Show original" in Gmail for three PASS results.

Common mistakes

Two SPF records on the same domain (invalid — merge them).
Pasting the full domain into the "host" field when your DNS provider adds it automatically (creating "_dmarc.yourdomain.com.yourdomain.com").
Jumping straight to p=reject before checking every service that sends as you (like your invoicing tool).

What happens behind the scenes

Here's what a mailbox provider like Gmail actually does when your email arrives:

It reads the sending server's address and looks up your domain's SPF record: is this server on your list? (SPF pass or fail.)
It finds the DKIM signature in the email's header, fetches your public key from DNS and checks that the signature matches the content. If someone changed even one character in transit, it fails. (DKIM pass or fail.)
It checks alignment: does the domain that passed SPF or DKIM match the domain in your visible From address? A scammer can pass SPF for their own domain — alignment is what stops them pretending to be yours.
It reads your DMARC policy and applies it to emails that fail: deliver anyway (none), send to spam (quarantine) or refuse (reject). It also sends you a daily report.

All of this takes milliseconds — and it happens to every email you send.

A complete example for "bakery.com"

Suppose Sunny Bakery sends newsletters through an email platform and uses Google Workspace for everyday email. Its DNS would contain:

SPF (TXT on bakery.com): v=spf1 include:_spf.google.com include:spf.emailplatform.com ~all — one record covering both services.
DKIM (TXT or CNAME on selector._domainkey.bakery.com): the public key provided by the email platform. Google Workspace has its own DKIM key under a different selector, so both can sign.
DMARC (TXT on _dmarc.bakery.com): v=DMARC1; p=none; rua=mailto:dmarc@bakery.com — monitoring only at first.

After a few weeks of clean DMARC reports, the bakery changes p=none to p=quarantine, and later to p=reject. From then on, anyone who tries to send fake email "from" bakery.com is blocked.

Reading DMARC reports without a headache

DMARC reports are XML files — not meant for humans. Use a free DMARC report viewer, or simply check:

Are your known services (email platform, Google Workspace or Microsoft 365, invoicing tool) all passing?
Is anything unknown sending as your domain? That could be a forgotten tool — or someone spoofing you.

Fix every legitimate service first, then tighten your policy.

Troubleshooting

SPF "permerror": you probably have two SPF records or more than 10 lookups. Merge or simplify.
DKIM fails after moving website hosts: the new host may have replaced your DNS. Re-add the DKIM record.
DMARC fails but SPF and DKIM pass: an alignment problem — the passing domain differs from your From domain. Send from an address on the authenticated domain.

In Reepio

Settings → Domains shows every record you need for your domain, checks them for you and keeps checking every day, warning you if a record breaks. Start free and get your domain authenticated in about ten minutes.

Frequently asked questions

Do I need all three: SPF, DKIM and DMARC?

Yes, if you send marketing email at any meaningful volume. Gmail and Yahoo require all three for bulk senders, and together they give the strongest protection against spoofing.

Can I have two SPF records?

No. A domain must have only one SPF record; two make SPF fail. Combine all the services that send for you into a single record.

What DMARC policy should I start with?

Start with p=none so nothing is blocked while you check reports. When all your legitimate email passes, move to p=quarantine and then p=reject.

How long do DNS changes take to work?

Often a few minutes, but changes can take up to 48 hours to be visible everywhere depending on your DNS provider and record settings.