Email Authentication: SPF, DKIM and DMARC Basics

You write a careful weekly digest. You send it to people who asked for it. And a share of it lands in spam, or does not arrive at all. It is not your writing. It is that the receiving system could not tell whether your message was really from you.

Email was designed in a more trusting age. Anyone could put any address in the "From" line. Three simple standards, SPF, DKIM and DMARC, were created to fix that. They are a little technical, and they are well worth an afternoon. This guide explains them plainly and shows a calm order of work. It is general information, and your provider's own instructions are the final word for your set-up.

The problem they solve

Without authentication, a stranger can send a message that claims to come from your domain. Phishing and scams rely on this. Mailbox providers respond by being suspicious of messages they cannot verify.

Google's sender guidelines, which apply to anyone sending email to personal Gmail accounts, make the position clear. All senders are required to set up SPF or DKIM authentication for their sending domains. Senders who send large volumes, defined in those guidelines as more than five thousand messages a day, must set up SPF, DKIM and DMARC. Messages that are not authenticated might be marked as spam or rejected. Other large providers have similar expectations.

Even for a small list, it is sensible to meet the higher standard. It protects your readers from impostors and your messages from the spam folder.

SPF: who may send for you

SPF stands for Sender Policy Framework. It is a published list of the servers allowed to send email for your domain.

You publish it as a line of text in your domain's DNS records, the public directory that tells the internet where your domain's services live. When a message arrives claiming to be from your domain, the receiver looks up that record and checks whether the sending server is on the list.

In plain words, an SPF record says: "These are the services that may send on my behalf, and anything else should be treated with suspicion."

Practical points:

• Include every service that sends for you: your email host, your newsletter tool, your payment receipts system.
• Have only one SPF record per domain. Multiple records cause errors. Combine them into one.
• Keep it short. There are limits on how many lookups an SPF record can trigger, and long lists can exceed them.
• Update it when you add or remove a service.

DKIM: a signature on each message

DKIM stands for DomainKeys Identified Mail. It adds a digital signature to each outgoing message. The signature is created with a private key held by your sending service, and the matching public key is published in your DNS.

When a message arrives, the receiver fetches the public key and checks that the signature matches. If it does, the receiver knows two things: the message really came from a system holding the key for that domain, and it has not been altered in transit.

In plain words, DKIM is a tamper-evident seal.

Practical points:

• Your sending service usually generates the key pair for you and gives you a DNS record to publish.
• You may need to publish it under a specific name that the service tells you.
• Use the strength of key your provider recommends.
• Keep a note of where each service's records live.

DMARC: what to do when checks fail

DMARC builds on SPF and DKIM. It lets you tell receivers two things: what to do if a message fails authentication, and where to send reports about what they saw.

The DMARC organisation explains its purpose: SPF and DKIM existed for years, but because many senders have complex environments with several systems sending mail, receivers struggled to decide what to do with messages that did not authenticate. DMARC provides a way for the domain owner to publish a policy and receive feedback.

A DMARC record can express three policies:

• None: do nothing special, just send reports. A safe starting point.
• Quarantine: treat failing messages as suspicious, often by placing them in spam.
• Reject: refuse failing messages.

Another idea in DMARC is alignment. For a message to pass, the domain in the visible "From" address must match, or align with, the domain verified by SPF or DKIM. Google's guidelines mention alignment explicitly as a requirement for passing DMARC.

A calm order of work

Do it in stages, and check at each one.

Step one: list every sender

Write down every system that sends email using your domain: your mail host, your newsletter service, your website forms, your invoicing tool, anything automated. Missing one is the most common reason authentication fails.

Step two: set up SPF

Publish a single SPF record that includes all of them, following each service's instructions. Test it.

Step three: set up DKIM for each service

Follow each service's steps to create and publish its DKIM record. Send a test message and check that the signature verifies. Many services have a button to check your set-up.

Step four: publish DMARC with a policy of none

Start with monitoring only. Include an address that can receive aggregate reports. These reports are technical but tell you which servers are sending as your domain and whether they pass.

Step five: read the reports for a few weeks

Look for legitimate senders that fail, such as a forgotten tool. Fix them by adding them to SPF or enabling DKIM.

Step six: tighten gradually

When everything legitimate passes, consider moving to quarantine, then reject, at your own pace. Stricter policies protect your domain from impersonation but raise the stakes of a mistake. Many small senders stop at a cautious level, and that is acceptable if it suits you.

Other basics that mailbox providers expect

Authentication is one piece. Google's guidelines also list, for all senders, things such as valid forward and reverse DNS records for sending servers, a secure connection for transmitting email, keeping spam complaint rates low and formatting messages according to the internet message standard. For bulk marketing mail, they require support for easy unsubscribing and a clearly visible unsubscribe link.

Most newsletter services handle several of these for you. Your part is to authenticate your domain, keep your list clean and send mail people want.

Use a proper domain

Send from an address on a domain you control, not from a free webmail address. A message "From" a free provider but sent through another service can fail alignment checks and look suspicious. A domain of your own also builds a recognisable identity.

Keep your reputation healthy

Authentication proves identity. Reputation decides what receivers think of that identity.

• Send only to people who asked.
• Remove addresses that bounce.
• Honour unsubscribes at once.
• Avoid sudden jumps in volume.
• Keep content honest, with subject lines that match what is inside.
• Watch complaint rates if your provider shows them.

A small, willing list with steady habits does better than a large, cold one.

Troubleshooting in plain steps

If messages are not arriving:

1. Send yourself a test to a few different providers and look at the headers, where most mail programs show whether SPF, DKIM and DMARC passed.
2. Check your records for typos or duplicates.
3. Check alignment. Does the visible From domain match what passed?
4. Check your service's status and instructions.
5. Look at DMARC reports for failing sources.
6. Ask your provider's support. They see these problems daily.

Be patient. DNS changes can take a while to spread.

Security of your own accounts

Authentication protects your domain's email from impostors. Protect the accounts that control it too: use strong, unique passwords and two-step sign-in on your domain registrar, your DNS provider and your sending service. If someone gains access to your DNS, they can undo everything above.

Common mistakes

• Forgetting a sending service.
• Two SPF records.
• Skipping DKIM.
• Jumping straight to a strict DMARC policy.
• Never reading the reports.
• Using a free webmail address as the sender.
• Weak security on DNS accounts.

On this site

The blog collects calm technical guides in plain language, the contact page opens a line to our support if you want to ask about how email works for listings here and the privacy page explains how addresses are handled. The submit page starts a listing.

A worked example for a small publication

Imagine a one-person digest that uses three services: a mailbox host for personal email, a newsletter tool for the weekly send and a form tool for sign-ups. She lists all three. She publishes one SPF record that includes the mailbox host and the newsletter tool, because the form tool only sends through the newsletter tool. She follows the newsletter tool's guide to publish its DKIM record under her domain, then sends a test and checks the headers: SPF pass, DKIM pass.

She publishes a DMARC record with a policy of none and an address to receive reports. After three weeks of reports she sees one unexpected source: an old invoicing tool she had forgotten, which sends receipts from her domain. She adds it to SPF and enables DKIM for it. After another month with clean reports, she moves to a quarantine policy. Total effort: a couple of hours spread over two months. Result: her digest reaches inboxes reliably, and nobody can easily impersonate her domain.

What to ask your sending provider

Before you choose or keep a provider, ask a few plain questions. Can I authenticate my own domain with both SPF and DKIM? Do you give clear instructions and a way to check the set-up? Do you support easy one-click unsubscribing? How do you handle complaints and bounces? Where do I see delivery problems? A good provider answers in plain words and is glad you asked, because a careful sender makes their own service look good.

The short version

SPF lists who may send for your domain, DKIM signs each message and DMARC tells receivers what to do when checks fail. Large mailbox providers expect at least SPF or DKIM from every sender and all three from bulk senders. List your senders, set up SPF and DKIM, start DMARC at none, read the reports, fix what fails and tighten slowly. An afternoon of careful set-up keeps a careful digest out of the spam folder.