DKIM, SPF, and DMARC Explained: The Complete Guide

Why Email Authentication Matters

Email was built in the 1980s with no built-in authentication. Anyone can send an email claiming to be from your domain. SPF, DKIM, and DMARC were created to fix that. Together, they prove that your emails are legitimate and tell receiving servers what to do with fakes.

If you skip these, your transactional emails will have deliverability problems. It is not a matter of if, but when.

SPF: Who Is Allowed to Send?

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain.

When a receiving server gets an email from yourapp.com, it checks the SPF record to see if the sending server's IP is authorized.

How to Set It Up

Add a TXT record to your domain's DNS:

Host: @
Type: TXT
Value: v=spf1 include:amazonses.com ~all

If you use multiple services, include them all:

v=spf1 include:amazonses.com include:_spf.google.com ~all

Key Rules

• You can only have one SPF record per domain. Multiple SPF records will cause failures.
• Use include: to authorize third-party senders.
• ~all means soft-fail for unauthorized senders (recommended). -all means hard-fail (stricter).
• Keep your SPF record under 10 DNS lookups. Exceeding this limit causes SPF to fail entirely.

Verify It Works

dig TXT yourapp.com | grep spf

You should see your SPF record in the output.

DKIM: Is the Email Authentic?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving server uses a public key (published in your DNS) to verify the signature.

Think of it as a tamper-proof seal. If anyone modifies the email in transit, the signature breaks.

How to Set It Up

Your email provider generates a DKIM key pair. You publish the public key as a DNS record. The exact record depends on your provider.

For SMTPfast (which uses AWS SES), you will add three CNAME records:

Host: abc123._domainkey.yourapp.com
Type: CNAME
Value: abc123.dkim.amazonses.com

Host: def456._domainkey.yourapp.com
Type: CNAME
Value: def456.dkim.amazonses.com

Host: ghi789._domainkey.yourapp.com
Type: CNAME
Value: ghi789.dkim.amazonses.com

SMTPfast generates these records for you when you add your domain in the dashboard.

Verify It Works

dig CNAME abc123._domainkey.yourapp.com

You should see the CNAME pointing to your provider's DKIM server.

DMARC: What Happens When Checks Fail?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It tells receiving servers:

1. Check SPF and DKIM
2. If both fail, here is what to do with the email
3. Send me reports about failures

How to Set It Up

Start with a monitoring-only policy:

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]

This tells receivers to send you reports but take no action on failures. Use this to monitor for problems before enforcing.

DMARC Policy Progression

Move through these stages over 2-4 weeks as you gain confidence:

Stage 1: Monitor

v=DMARC1; p=none; rua=mailto:[email protected]

Stage 2: Quarantine a percentage

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]

Stage 3: Quarantine all

v=DMARC1; p=quarantine; rua=mailto:[email protected]

Stage 4: Reject

v=DMARC1; p=reject; rua=mailto:[email protected]

DMARC Tags Explained

Verify It Works

dig TXT _dmarc.yourapp.com

How the Three Work Together

Here is what happens when someone receives an email from your domain:

1. SPF check - Is the sending server authorized? Check the SPF record.
2. DKIM check - Is the signature valid? Check the DKIM public key.
3. DMARC check - Did SPF or DKIM pass with domain alignment? If not, apply the DMARC policy.

An email passes DMARC if either SPF or DKIM passes and the domain aligns. You do not need both to pass, but having both gives you a safety net.

Common Mistakes

Multiple SPF records. You can only have one. Merge them into a single record.

Jumping straight to p=reject. Start with p=none, check your reports, and escalate gradually.

Forgetting subdomains. If you send from mail.yourapp.com, your DKIM and SPF records need to cover that subdomain.

Not monitoring DMARC reports. Set up the rua tag and actually read the reports. Services like Postmark's DMARC monitoring or dmarcian make this easier.

Quick Setup with SMTPfast

When you add a domain in the SMTPfast dashboard, you get all the DNS records you need:

1. Three CNAME records for DKIM
2. A recommended SPF include
3. A suggested DMARC record

Add them to your DNS provider, wait for propagation (usually under an hour), and your domain is fully authenticated.

Checklist

• SPF record added with correct includes
• Only one SPF record per domain
• DKIM CNAME records added
• DMARC record added (start with p=none)
• DMARC report email monitored
• All records verified with dig or an online checker
• Gradually escalate DMARC policy over 2-4 weeks