Guide
Three DNS records that tell inboxes your email is really yours. What each does, example records, and how to test.
Example values use example.com. Use the exact values your sending service gives you.
SPF
Who may send for your domain.
DKIM
A signature that proves the message is untouched.
DMARC
What to do when the first two fail.
Anyone can type your domain into the From line of an email. Inboxes know this, so they check three things before they trust a message that claims to come from you: was the sending server allowed (SPF), is the message signed and unchanged (DKIM), and what do you want done when those checks fail (DMARC).
If the checks are missing, the message looks the same as a forged one. It gets filtered, or lands in spam, even if the content is fine. Since 2024, Gmail and Yahoo have asked bulk senders (more than 5,000 messages a day to their users) to have all three in place.
Lists the servers allowed to send mail for your domain.
v=spf1 include:sender.example.net ~allA domain may have only one SPF record. If you already have one, add the new include inside it instead of creating a second record. SPF also allows at most 10 DNS lookups.
Signs each message so receivers can tell it was not changed on the way.
selector1._domainkey.example.com CNAME selector1.sender.example.netYour sending service holds the private key and signs each message. You only publish the public part in DNS. Copy the exact name and value it shows you.
Tells receivers what to do when SPF and DKIM fail, and sends you reports.
v=DMARC1; p=none; rua=mailto:[email protected]Start with p=none so nothing is blocked while you watch the reports. Move to quarantine, then reject, once every legitimate sender passes.
App email, your mailbox provider, a newsletter tool, a support desk. Each needs to pass SPF or DKIM, or DMARC will flag it.
Add one TXT record that includes every sender. Keep it to a single record.
Add the DKIM record your sending service gives you. Add one for each service that sends.
Add the _dmarc TXT record and point rua at an inbox you read.
Send a message to a Gmail address, open it, choose Show original and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
Fix any legitimate sender that fails. Then move the policy to quarantine and finally reject.
Yes. SPF and DKIM prove who sent the message, and DMARC tells receivers how to treat failures. Gmail and Yahoo began requiring all three from bulk senders in 2024, and having them helps everyone else too.
They remove one common reason for it, and without them delivery is much harder. They do not guarantee the inbox: content, sending patterns and complaint rates matter too.
Often a few minutes, sometimes a few hours. Your DNS provider shows the record lifetime (TTL), which is the longest a stale answer should last.
When you add a domain, the dashboard shows the exact records to publish and checks MX, SPF, DKIM and DMARC for you, so you can see what is still missing.
Choosing a sender? See how Traffsite compares in Amazon SES alternative.
Add your domain and see what passes and what is still missing.