SPF, DKIM and DMARC are three DNS records that prove an email really comes from your domain. SPF lists the servers allowed to send your mail. DKIM signs each message so it can’t be altered. DMARC tells receiving servers what to do when a message fails both, and sends you reports. Gmail requires at least SPF or DKIM from every sender, and all three from anyone sending 5,000+ messages a day.
You can check whether a domain publishes SPF and DMARC in one click with our free Domain Reputation Checker. This guide explains what each record does, what a working one looks like, and the mistakes that send mail to spam.
The Three Records at a Glance
| Record | Where it lives | What it proves | Example |
|---|---|---|---|
| SPF | TXT record on the domain itself | The sending server is allowed to send for this domain | v=spf1 include:_spf.google.com ~all |
| DKIM | TXT record at selector._domainkey.example.com | The message was signed by the domain and not changed in transit | v=DKIM1; k=rsa; p=MIIBIjANBg… |
| DMARC | TXT record at _dmarc.example.com | The visible From address matches a domain that passed SPF or DKIM, and what to do if not | v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com |
SPF: Who Is Allowed to Send
An SPF record is a list of servers. When a message arrives, the receiving server looks at the IP it came from and checks whether your SPF record includes it. Each email service you use (Google Workspace, Microsoft 365, a newsletter tool, your web host) gives you an include: value to add.
The ending matters. ~all (softfail) tells receivers to treat unlisted servers with suspicion. -all (fail) tells them to reject. Most providers recommend ~all and leave enforcement to DMARC.
Two rules break more SPF records than anything else:
- Only one SPF record per domain. If you add a second
v=spf1record for a new service instead of merging it into the first, SPF fails for every message. - No more than 10 DNS lookups. Each
include:,a,mxandredirectcosts a lookup, and includes can contain includes. Past 10, the record returns a permanent error and counts as failed. Remove services you no longer use before adding new ones.
DKIM: A Signature on Every Message
DKIM adds a cryptographic signature to the headers of each message. The receiving server fetches your public key from DNS and verifies it. If someone changes the message on the way, or forges it, the signature fails.
The key lives at a name your email provider chooses, called the selector: selector._domainkey.yourdomain.com. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2. Because the selector can be anything, no outside tool can look up a domain’s DKIM key without being told the selector. That’s why our checker tests SPF and DMARC, but not DKIM.
You set up DKIM in your email provider’s admin panel: it generates the key, you paste it into DNS, then you switch signing on. Skipping that last step is common.
DMARC: The Policy That Ties Them Together
SPF and DKIM each check a domain, but not necessarily the one your reader sees in the From line. DMARC closes that gap. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From address. That match is called alignment.
The p= tag sets what receivers do with messages that fail:
p=none: deliver as normal, just send reports. Use it to start.p=quarantine: treat as suspicious, usually the spam folder.p=reject: refuse the message.
The rua= tag is the address that receives daily aggregate reports. Read them for two to four weeks at p=none to find every service that sends as you (billing tools, CRMs, contact forms), fix their SPF or DKIM, then move to p=quarantine.
What Happened When We Tightened Ours
We moved domainanalyzer.com from p=none to p=quarantine in September 2026. The same week, a test of the report emails our site sends landed in Gmail spam. The cause was exactly what DMARC exists to catch: the website sent mail from its web server’s IP address, which our SPF record didn’t list, and nothing signed it with DKIM. Gmail saw a message claiming to be from our domain that passed neither check, and followed our own policy.
The fix was to send through our mailbox provider’s authenticated SMTP server instead, which SPF covers and DKIM signs. The lesson for anyone tightening DMARC: list every system that sends mail as your domain first, including the website itself. Contact forms and order confirmations are the usual blind spot.
How to Check Your SPF, DKIM and DMARC
- Run a reputation check. Our Domain Reputation Checker looks up SPF and DMARC and grades email authentication: pass if both exist, warn if one is missing, fail if neither.
- Read each record. The SPF Checker explains every term and counts the DNS lookups. The DMARC Checker reads the policy. The DKIM Checker looks up a key by its selector. The DNS Lookup shows every TXT record, so you can spot a duplicate SPF record.
- Test a real message. Send an email to a Gmail address, open it, and choose Show original. Gmail lists SPF, DKIM and DMARC as PASS or FAIL for that message. This is the only check that covers DKIM and alignment.
- Ask your AI assistant to watch it. Our free JSON endpoint,
https://domainanalyzer.com/wp-json/dat/v1/domain/yourdomain.com, returns the SPF record, the DMARC record and its policy. An assistant can check it weekly and tell you if either disappears.
Passing all three doesn’t guarantee the inbox. Authentication proves who sent a message. Gmail and Outlook still judge your sending reputation from spam complaints and engagement. Our reputation checker explains the difference between the two.
Frequently Asked Questions
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send mail for your domain. DKIM signs each message so tampering or forgery is detectable. DMARC checks that the From address matches a domain that passed SPF or DKIM, and tells receivers whether to deliver, quarantine or reject failures.
Do I need all three?
Gmail requires SPF or DKIM from every sender, and SPF, DKIM and DMARC from senders of more than 5,000 messages a day to Gmail. Publishing all three is the safe default for any domain that sends email.
How do I check if a domain has SPF and DMARC?
Enter the domain in our free Domain Reputation Checker. It looks up both records and grades email authentication as pass, warn or fail.
Why can’t I look up a domain’s DKIM record?
The DKIM key lives at a selector name the email provider chooses, such as google._domainkey. Without knowing the selector, there is no name to query. Check DKIM by opening a received message’s headers instead.
Can I have two SPF records?
No. A domain must publish exactly one SPF record. Two records make SPF fail for every message. Merge the include: entries into a single record.
Which DMARC policy should I use?
Start with p=none and a rua address to receive reports. Once the reports show every legitimate sender passing, move to p=quarantine, then p=reject.
Sources: RFC 7208 (SPF), sections 3.2 and 4.6.4; RFC 7489 (DMARC); Google email sender guidelines, checked September 2026.