If you’ve ever been told to “check your SPF record,” you’re not alone in wondering what that means. SPF, DKIM and DMARC sound technical, but the idea behind them is simple: they prove your emails are really from you.
01 The problem they solve
Email was invented without any way to prove who sent a message. Anyone can type your address into the “from” line, which is exactly what scammers do. These three records, added to your domain’s DNS, give inboxes a way to tell your real emails apart from fakes.
When they’re missing, inboxes have to guess. More and more, they guess “spam.”
02 SPF: the guest list
SPF is a list of the services allowed to send email using your domain. If you use Google Workspace for email, a newsletter tool for marketing and your website for contact forms, all three need to be on the list.
03 DKIM: the signature
DKIM adds a hidden digital signature to every email you send. The receiving inbox checks that signature against a key published in your DNS. If it matches, the inbox knows the message came from you and wasn’t changed along the way.
Each service that sends for you, like Google Workspace, Microsoft 365 or your email marketing tool, gives you its own DKIM record to add.
04 DMARC: the instructions
DMARC tells inboxes what to do when an email claiming to be from you fails the SPF and DKIM checks. It has three settings:
05 Setting them up the right way
- List every service that sends email using your domain, including ones you might forget, like your website and invoicing software.
- Build one SPF record that includes all of them, and add each service’s DKIM record.
- Start DMARC at “none” and read the reports for a few weeks.
- Once everything passes, move DMARC to “quarantine” or “reject.”
Done in that order, you get better delivery without accidentally blocking your own emails. It’s usually an hour or two of work, and it keeps paying off every time you hit send.
