All guides · Security

Email Authentication: SPF and DMARC

Anyone can send an email that claims to come from you@example.com. Email authentication lets receiving mail servers check whether a message really came from a server you approved. Two of the standards involved are published as DNS records you control: SPF and DMARC. A third, DKIM, adds a cryptographic signature to each message.

Why it matters

Without these records, attackers can send phishing or invoice-fraud emails that appear to come from your domain, and receivers have no reliable way to tell them apart from your real mail. That hurts your customers and your reputation, and it can also hurt delivery of your genuine email.

Large mailbox providers, including Gmail and Yahoo, have required SPF, DKIM and DMARC from bulk senders since 2024. Even a domain that sends no email needs records, so it cannot be used for spoofing.

• SPF lists the servers allowed to send mail for your domain.
• DKIM signs each message so receivers can verify it was not altered and was sent with your key.
• DMARC ties them together: it tells receivers what to do when a message fails SPF and DKIM for your domain, and where to send reports.

What we check

We look up DNS TXT records for the scanned domain, without a leading www..

• SPF fails if there is no record, if there is more than one (receivers then treat SPF as broken), or if it uses +all, which authorizes every server on the internet. A record that ends in ?all or has no all mechanism is reported as “needs attention”.
• DMARC fails if there is no record. p=none is reported as “needs attention”: it only collects reports and asks receivers to take no action on failing mail.

We do not check DKIM. DKIM keys are published under selector names that only the sender knows (<selector>._domainkey.<domain>), so they cannot be found reliably from outside.

How to fix

SPF

Publish one TXT record on the bare domain that lists every service that sends mail as you. Each email provider documents the include: value to use. For example, for a domain that uses Google Workspace and a newsletter service:

example.com.  TXT  "v=spf1 include:_spf.google.com include:spf.newsletter.example -all"

• -all tells receivers to reject anything not listed. ~all (softfail) asks them to treat it as suspicious; it is a reasonable starting point, and DMARC decides the final outcome anyway.
• If you have several SPF records, merge them into one.
• SPF allows at most 10 DNS lookups in total, counting every include, a, mx, exists and redirect, including nested ones. Remove services you no longer use before you hit the limit.

DKIM

Turn on DKIM signing in each service that sends mail for you. The provider gives you a record to publish, usually a TXT or CNAME record under <selector>._domainkey.

DMARC

Publish a TXT record at _dmarc.example.com. Start in monitoring mode so you can see who sends mail as you before anything is blocked:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Then tighten it in steps:

1. p=none for a few weeks. Read the aggregate reports sent to the rua address (a DMARC report service makes them much easier to read). Find every legitimate sender and make sure each passes SPF or DKIM with your domain.
2. p=quarantine: failing mail goes to spam. Watch the reports and your own delivery for a while before the last step.
3. p=reject: failing mail is refused. This is the goal.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Moving too fast can send your own invoices, password resets or newsletters to spam, so let the reports guide each step.

Domains that send no email

Lock them down completely:

example.com.         TXT  "v=spf1 -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject;"
example.com.         MX   0 .

The last record is a “null MX” (RFC 7505), which states that the domain accepts no mail. Only add it if the domain really receives no email.

Subdomains

A DMARC record on the bare domain also applies to subdomains unless you set a different subdomain policy with the sp tag. SPF does not inherit: a subdomain that sends mail needs its own SPF record.

Verify

After DNS changes propagate, check the records:

dig +short TXT example.com
dig +short TXT _dmarc.example.com

Then send a message to an external mailbox and view the original headers. Look for spf=pass, dkim=pass and dmarc=pass in the Authentication-Results header.

Further reading: RFC 7489: DMARC and RFC 7208: SPF.

Last updated October 24, 2026