Mailbase
Start free
DeliverabilityUpdated · 7 min read

SPF, DKIM, and DMARC Explained Simply

SPF, DKIM, and DMARC explained in plain English: what each record does, how they work together to authenticate your email, how to set them up, and the common mistakes that break them.

MT
Mailbase Team
SPF DKIM DMARC explained
On this page · 8 sections

Overview

SPF, DKIM, and DMARC are the three DNS records that prove your email is really from you. Mailbox providers use them to decide whether to trust a message, and since February 2024 Gmail and Yahoo effectively require them for bulk senders — without them, your mail is far more likely to land in spam or be rejected. They sound intimidating but each has one job, and together they answer a simple question: "is this sender allowed to send as this domain, and was the message tampered with?"

What each record does

SPF (Sender Policy Framework) is a DNS TXT record listing which servers are allowed to send email for your domain — the receiver checks that the sending server is on the list. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message; the receiver verifies it against a public key in your DNS, proving the email wasn't altered and genuinely came from your domain. DMARC ties the two together: it tells receivers what to do when SPF or DKIM fails (none/quarantine/reject) and where to send reports, and it requires "alignment" between the visible From domain and the authenticated one.

An analogy: SPF is the guest list (is this sender approved?), DKIM is the tamper-proof seal (was the letter opened?), and DMARC is the policy the bouncer follows when something doesn't match, plus the incident log.

  • SPF — DNS list of servers allowed to send for your domain
  • DKIM — cryptographic signature proving the message is intact and yours
  • DMARC — policy (none/quarantine/reject) + alignment + reporting
  • All three are DNS records on your sending domain

Setup, and the mistakes that break it

Setup order: publish SPF and DKIM (your sending provider gives you the exact records; Mailbase shows them for every domain you add), confirm both pass, then add DMARC starting at p=none to monitor reports without affecting delivery, and tighten to quarantine then reject once you're confident everything legitimate aligns. Use the free domain check to verify each passes before relying on it, and the SPF record generator and DMARC record generator to write the records.

Common mistakes: more than one SPF record (only one is allowed — merge them), exceeding SPF's 10-DNS-lookup limit, forgetting to authenticate a new sending tool you added, or jumping straight to p=reject and blocking your own mail. Authentication isn't one-and-done — re-check it whenever you add a sender.

  • Publish SPF + DKIM from your provider's exact records
  • Add DMARC at p=none, then quarantine, then reject
  • Only one SPF record; stay under 10 DNS lookups
  • Re-authenticate every new sending tool you add

Common mistakes

  • Skipping SPF, DKIM, and DMARC, or assuming they're a one-time setup.
  • Sending real volume from a brand-new, un-warmed domain.
  • Reusing a stale list without re-verifying, so bounces spike.
  • Ignoring complaint rate until a single bad campaign sinks the domain.

Sources and further reading

Official docs for current setup details, pricing, and API behavior — verify specifics there, since they change.

Amazon SES docsSupabase custom SMTP docs

Related guides

More on spf dkim dmarc explained and the surrounding deliverability workflow:

free domain checkdeliverability and honest warm-upbounce managementsuppression listsunsubscribe best practicessender domain docsunsubscribe and compliance docs
Questions

About this page.

What are SPF, DKIM, and DMARC?
Three DNS records that authenticate your email. SPF lists which servers may send for your domain, DKIM adds a cryptographic signature proving the message is intact and genuinely yours, and DMARC tells receivers what to do when those checks fail (and sends you reports). Together they prove your mail is really from you.
Do I really need all three?
Yes, for reliable delivery. Gmail and Yahoo effectively require SPF, DKIM, and DMARC for bulk senders as of 2024, and missing any of them increases spam placement and rejections. They're the baseline of modern deliverability, not optional extras.
How do I set up DMARC safely?
Publish SPF and DKIM first and confirm they pass, then add a DMARC record at p=none to collect reports without affecting delivery. Once you've confirmed all your legitimate mail aligns, tighten the policy to quarantine and then reject. Jumping straight to reject can block your own email.
Why is my SPF or DKIM failing?
Common causes: more than one SPF record (only one is allowed), exceeding SPF's 10-lookup limit, a new sending tool you forgot to authenticate, or a mistyped DNS record. Use an SPF/DKIM/DMARC checker to see exactly which check fails and why.