SPF, DKIM, and DMARC Explained (in Plain English)

If you send marketing email, three acronyms decide whether you land in the inbox or the spam folder: SPF, DKIM, and DMARC. They sound intimidating, but the ideas behind them are simple. Here's the plain-English version.

They're all forms of email authentication — ways of proving to Gmail, Outlook, and every other mailbox provider that an email claiming to be from your domain is actually from you. Without them, anyone could spoof your domain, and inbox providers treat unauthenticated mail with suspicion.

Want to check your domain right now? Use our free SPF & DKIM checker to see which records you have set up.

SPF: who's allowed to send for you

SPF (Sender Policy Framework) is a list of the servers and services that are allowed to send email on behalf of your domain. It's a single DNS record (a TXT record) that looks something like:

v=spf1 include:mailgun.org ~all

When a mailbox provider receives an email from your domain, it checks whether the sending server is on your SPF list. If a service you use to send (like your email platform) isn't included, its mail can fail SPF and look suspicious.

The catch: you can only have one SPF record per domain. If you send through multiple services, you merge them into a single record with multiple include: entries — you don't add a second SPF record.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. Your sending platform signs the message with a private key, and the matching public key lives in your DNS. The receiving server uses it to verify two things: that the email really came from your domain, and that it wasn't altered in transit.

DKIM is usually set up as one or two CNAME records pointing at your email provider. You don't paste a giant key yourself — you just point the records where your provider tells you to.

DMARC: your policy for failures

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together and tells mailbox providers what to do when a message fails authentication — nothing, quarantine it, or reject it. It also lets you receive reports on who's sending mail using your domain.

A safe starting DMARC record just monitors, without blocking anything:

v=DMARC1; p=none;

As you confirm your legitimate mail is authenticating correctly, you can tighten the policy to quarantine or reject to actively stop spoofing.

How they work together

Think of it as three checks on every email:

1. SPF — was this sent from a server I authorized?
2. DKIM — is this cryptographically signed by me and unaltered?
3. DMARC — if the first two fail, what should the inbox do about it?

Pass all three, and you look like exactly what you are: a legitimate sender. That's the foundation of good deliverability.

How to set them up

The good news: your email platform generates these records for you. In Audienceful, adding your custom sending domain walks you through the exact SPF, DKIM, and (recommended) DMARC records to add at your registrar, and verifies them for you — including catching the two most common setup mistakes. For a deeper dive on DMARC specifically, see our DMARC guide.

Set these three up once, and you've done the single most important thing for staying out of spam. Check your domain with our free tool →