Term · Security & infrastructure
SPF, DKIM and DMARC
SPF, DKIM and DMARC are three email authentication standards, published as DNS records, that let receiving mail servers check whether a message claiming to come from your domain is genuine. Together they protect against spoofing — fake emails sent in your company's name — and help your legitimate email reach inboxes.
[ 01 ]
Explained
SPF (Sender Policy Framework)
A TXT record listing the servers and services allowed to send email for your domain. Receivers check whether the sending server is authorised.
DKIM (DomainKeys Identified Mail)
A cryptographic signature added to outgoing messages. The public key is published in DNS; receivers verify that the message was signed by an authorised sender and not altered.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
A policy record that tells receivers what to do when a message fails SPF and DKIM alignment with the visible "From" domain — nothing (p=none), send to spam (p=quarantine) or reject (p=reject) — and where to send reports.
How they work together
SPF and DKIM provide the checks; DMARC connects them to the domain users see and sets enforcement. A gradual rollout — monitoring first, then quarantine, then reject — avoids blocking legitimate mail from forgotten services.
Why it matters
- Stops criminals from using your exact domain in phishing — fake invoices and payment instructions are a common fraud against businesses.
- Major email providers increasingly expect authentication from senders.
[ 02 ]
FAQ
Frequently asked questions
Do we need all three?
Yes. Each covers a different aspect; DMARC depends on SPF and DKIM.
Can they break our email?
If a legitimate sending service is missing from SPF or DKIM when DMARC enforces, its messages fail. Monitor reports before enforcing.