What are SPF, DKIM and DMARC? They’re three DNS records that prove your emails really come from your business. SPF lists which services may send email for your domain, DKIM adds a tamper-proof signature to each email, and DMARC tells receiving servers what to do when an email fails those checks.
Without them, your quotes, invoices and website form notifications are more likely to land in spam. And anyone can send fake emails that look like they came from your domain.
Since 2024, Google and Yahoo require these records from bulk senders, and every business benefits from having them.
Why your emails go to spam
Email was designed decades ago with no way to check who really sent a message. Anyone can put your address in the “From” line.
Gmail, Outlook and other providers protect their users by checking whether an email claiming to be from your domain was sent by a service your domain has approved. If they can’t tell, they treat the email with suspicion.
SPF, DKIM and DMARC are how you give them the answer.
SPF: who is allowed to send
SPF is a TXT record that lists the services allowed to send email for your domain. For example: your Google Workspace or Microsoft 365 account, your website’s email service, and your newsletter tool.
Key points:
- You can only have one SPF record per domain. Two SPF records break it. Combine them into one.
- Every service that sends as your domain needs to be included.
- SPF has a limit of 10 DNS lookups. Adding too many services can exceed it, so keep the list tidy.
DKIM: a signature on every email
DKIM adds a digital signature to every email you send. The receiving server checks it against a public key published in your DNS. If the email was changed along the way, or wasn’t signed by your service, the check fails.
How to set it up: each sending service generates its own DKIM key. You copy the record it gives you into your DNS, then turn on signing in that service’s admin panel. Do this for every service that sends email for you.
DMARC: the rules and the reports
DMARC ties SPF and DKIM together. It tells receiving servers:
- What to do with emails that fail: nothing, send them to spam, or reject them.
- Where to send reports about who is sending email using your domain.
DMARC has three policy levels:
| Policy | What happens to failing emails |
|---|---|
| p=none | Nothing. You just receive reports. The safe starting point. |
| p=quarantine | Sent to spam. |
| p=reject | Blocked completely. The strongest protection against fake emails. |
How to set them up safely
Work through this in order. Rushing to a strict DMARC policy can block your own genuine emails.
- List every service that sends email as your domain. Business email, website forms, online shop, newsletter tool, invoicing software, booking system.
- Set up SPF with all of them in a single record.
- Turn on DKIM in each service and add their records to your DNS.
- Add a DMARC record with p=none and an address for reports. A free DMARC report service makes the reports readable.
- Watch the reports for a few weeks. Look for genuine services that are failing, and fix them.
- Move to p=quarantine, then later to p=reject, once only spoofed emails are failing.
Don’t forget your website
Your WordPress site sends emails too: form notifications, password resets and order confirmations. By default, it sends them from the web server, which usually isn’t in your SPF record and doesn’t sign with DKIM. That’s a big reason form emails go missing.
The fix is to send website email through an authorised service using SMTP. I explain it step by step in WordPress contact form not sending emails.
How to check your records
- Send an email to a Gmail address, open it, and use Show original. You’ll see whether SPF, DKIM and DMARC passed.
- Use a free online DNS checker to view your SPF and DMARC records.
- Read your DMARC reports regularly, at least for the first few months.
Before you change DNS
DNS controls your email and website. One wrong edit can stop email arriving. Before changing anything:
- Take a screenshot of the current records.
- Change one thing at a time.
- Send test emails after each change.
If you’re not sure where your DNS lives, start with domain, hosting and DNS explained.
Setting up email authentication is part of my webmaster services. It’s a one-time job that keeps paying off every time an email lands in an inbox instead of spam.
Frequently asked questions
Do I need these if I only send a few emails a day?
Yes. The strict requirements apply to bulk senders, but Gmail and Outlook use these checks for everyone. Small senders without them still see more emails go to spam.
Can SPF, DKIM and DMARC stop people faking my email address?
DMARC at quarantine or reject stops most direct spoofing of your exact domain. It can’t stop look-alike domains with a small spelling change, so warn staff about those.
I added a second SPF record and email broke. Why?
A domain can only have one SPF record. With two, both fail. Merge them into a single record that includes all your sending services.
Will setting up DMARC break my email?
Not if you start with p=none. That policy only collects reports. Problems happen when people jump straight to reject before checking that all genuine services pass.
About the author
Vincent Earl Panoncial is a WordPress developer and the founder of VEP Studio. He has built and maintained 100+ WordPress websites, most of them at digital marketing agencies, and now works directly with businesses on development, maintenance and webmaster services.
Need a hand with your WordPress site?
Tell me what your website needs and you’ll get a clear plan and an honest answer on cost before any work starts. Get a free consultation →
