SPF vs DKIM vs DMARC: what they actually do and why you need all three

Every email you send passes through three separate trust checks before it hits an inbox. Miss any one of them and Gmail, Outlook, or Yahoo might quietly file your message under Spam — or reject it outright. This is the plain-English guide to what SPF, DKIM, and DMARC actually do, why you need all three, and how to check yours right now.

SPF — who's allowed to send from your domain?

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are authorized to send email from your domain. When Gmail receives a message claiming to be from[email protected], it looks up the SPF record for yourbrand.comand checks: is the server that just delivered this message on the list?

A minimal SPF record looks like this:

v=spf1 include:_spf.securessmtp.com ~all

The include: directive delegates to your provider's SPF list, so you don't have to track every IP they use. The ~all at the end tells receiving servers to soft-fail unknown sources (mark as suspicious, but often still deliver).

DKIM — proof the message wasn't tampered with

DKIM (DomainKeys Identified Mail) signs the message body and headers with a cryptographic key. The public key lives in your DNS; only your provider has the private key. When Gmail receives your email, it verifies the signature — proving both that you sent it, and that nothing changed in transit.

The DNS record is a TXT record at selector._domainkey.yourbrand.com. Your provider generates it; you copy-paste it into your DNS. Once it's live, every message you send is signed.

DMARC — what to do when SPF or DKIM fail

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the policy layer. It tells receivers: "When a message claiming to be from my domain fails SPF or DKIM, here's what to do about it." Three options:

• p=none — monitor only. Get reports, take no action.
• p=quarantine — send suspicious mail to spam.
• p=reject — reject suspicious mail at the SMTP level.

DMARC also enables aggregate reports: daily emails from receivers telling you exactly who's sending mail as your domain (including phishers trying to spoof you). Point rua=at an inbox you check.

Why you need all three

Miss SPF: Gmail can't verify the sending server. Miss DKIM: Gmail can't verify the message hasn't been tampered with. Miss DMARC: Gmail has no policy from you on what to do with failed messages, so it uses its own judgment — usually pessimistic.

Modern receivers (Google and Yahoo bulk-sender rules from 2024, then the 2026 tightening) require all three for sending to gmail.com and yahoo.com in volume. Without them, delivery drops off a cliff around 5,000 messages per day.

How to check yours right now

Two quick options:

1. Command line: dig TXT yourbrand.com for SPF, dig TXT securessmtp._domainkey.yourbrand.com for DKIM, dig TXT _dmarc.yourbrand.com for DMARC.
2. Free tool: our Email Deliverability Test checks all three in one pass and points at anything missing.

The short version

SPF proves who you are. DKIM proves the message wasn't changed. DMARC ties them together and tells receivers what to do when either fails. Set up all three the day you start sending; the day you actually need them is the day it's too late.