Email for Your Domain: SPF, DKIM, and DMARC Explained

Having email addresses on your own domain, like hello@yourbusiness.com, looks professional. But if your messages go to spam or can be spoofed by scammers, that professionalism is lost. Three DNS-based standards, SPF, DKIM, and DMARC, help prove that email from your domain is genuine.

Why it matters

Deliverability. Mailbox providers check these records to decide whether to trust your messages. Without them, legitimate email, including contact form replies, invoices, and newsletters, is more likely to land in spam.
Protection from spoofing. Criminals can send emails that appear to come from your domain. Authentication gives receiving servers a way to reject them.
Requirements. Large mailbox providers have introduced stricter requirements for senders who send high volumes. Even if you send fewer, setting these up is good practice.

SPF: who may send

Sender Policy Framework is a DNS TXT record listing the servers and services allowed to send email for your domain. Receivers check whether the message came from one of them.

Tips

Have only one SPF record per domain. Combine all senders into it
Include every service that sends mail as you: your email provider, newsletter tool, invoicing system, CRM, and website forms
SPF has a limit on the number of DNS lookups it can trigger, so avoid adding unnecessary includes
End with a policy that matches your confidence level, as recommended by your provider

DKIM: a digital signature

DomainKeys Identified Mail adds a cryptographic signature to outgoing messages. The matching public key is published in your DNS. Receivers use it to verify that the message came from you and wasn't altered.

Tips

Your email provider and each sending service usually give you a DKIM record to add
Each sending service typically needs its own DKIM setup
Use the key length and selector your provider recommends

DMARC: what to do when checks fail

Domain-based Message Authentication, Reporting and Conformance builds on SPF and DKIM. A DMARC TXT record tells receivers what to do if a message fails authentication (nothing, quarantine, or reject), and where to send reports.

A sensible approach

Start with monitoring (a policy of "none") and set an address to receive reports. Review who is sending mail as your domain.
Fix any legitimate senders that fail.
Move to a stricter policy (quarantine, then reject) once you're confident that everything legitimate passes.

DMARC checks that the domain in the visible "From" address aligns with the domain authenticated by SPF or DKIM.

Setting it up

List everything that sends email as your domain.
Add the SPF record in DNS. See how DNS works
Enable DKIM in each sending service and publish the records.
Add a DMARC record, starting with monitoring.
Send test emails to different mailbox providers and check the headers, or use online testing tools.
Review DMARC reports over a few weeks, and tighten.

Website contact forms

Forms that send email "from" your domain via a generic server are a common cause of failures. A better approach is to send via your email provider or a transactional email service that you have authenticated, and use the visitor's address only in the reply-to field. See thank-you page best practices for confirmation emails.

Common mistakes

Multiple SPF records
Forgetting a sending service, so its mail fails
Leaving DMARC at monitoring forever
Deleting records when changing nameservers or hosts
Not updating records when changing email providers

Also protect the accounts

Secure email logins with two-factor authentication, since a compromised mailbox defeats all of this. See password managers for small teams and how to keep your website secure.

Newsletters

If you send marketing email, authentication helps it reach inboxes, alongside permission and good content. See email newsletter basics.

The bottom line

Set up SPF, DKIM, and DMARC so your emails are trusted and your domain is harder to spoof. Start with monitoring, fix gaps, then tighten.