SPF, DKIM, DMARC Explained: Email Authentication for Beginners
· 8 min
Why authentication matters
Inbox providers like Gmail, Outlook, and Apple Mail use email authentication to verify that you are who you say you are. Without proper authentication, anyone can send email claiming to be from your domain — a practice called spoofing. In 2024, Google and Yahoo both made SPF and DKIM mandatory for senders of 5,000+ emails per day.
SPF — Sender Policy Framework
SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When a recipient's server receives your email, it checks your domain's SPF record to verify the sending server is authorized. If the sending server isn't listed, the email may be marked as spam or rejected. Example SPF record: v=spf1 include:sendgrid.net ~all
DKIM — DomainKeys Identified Mail
DKIM adds a cryptographic signature to every email you send. The recipient's server retrieves your public key from your DNS and uses it to verify the signature. If the signature is valid, the email hasn't been tampered with in transit. DKIM is set up by your email service provider and added as a TXT record in your DNS.
DMARC — Domain-based Message Authentication
DMARC builds on SPF and DKIM by telling receiving servers what to do when authentication fails: nothing (p=none), send to spam (p=quarantine), or reject outright (p=reject). It also sends aggregate reports back to you so you can see who is sending email in your name. Start with p=none to monitor, then tighten to p=quarantine or p=reject once you're confident in your setup.
Setting up all three
Step 1: Create an SPF TXT record in your DNS listing all your authorized sending services. Step 2: Enable DKIM signing in your ESP and add the CNAME or TXT records they provide. Step 3: Create a DMARC TXT record at _dmarc.yourdomain.com starting with p=none and rua/ruf reporting addresses. Use a DMARC analyzer to monitor the reports and gradually enforce stricter policies.
Authentication and deliverability
Proper authentication doesn't guarantee inbox placement, but missing it almost guarantees spam folder placement. Combined with a clean, validated list and consistent sending practices, SPF + DKIM + DMARC form the foundation of strong deliverability. Check your authentication status regularly using tools like MXToolbox or Google's Check MX.