SPF, DKIM and DMARC Explained (and Why Your Emails Land in Spam)

Hello, tech enthusiasts! 👋

You send an invoice to a customer. They never see it. A week later, they find it in their spam folder. Sound familiar?

Often the problem is not your message. The problem is that the receiving server cannot check that the email really came from you. Anyone can write any “From” address on an email, a bit like writing any return address on an envelope. So mail servers look for proof.

That proof comes from three DNS records: SPF, DKIM and DMARC. Let us make them simple.

What you need

  • Your own domain, for example example.com
  • Access to your domain’s DNS settings (DNS is the internet’s phone book: it turns names into addresses)
  • The setup values from your email provider

Step 1: Understand the three records

Think of sending a letter from your company.

  • SPF is the list of post offices allowed to send your letters. The receiver checks: “Did this email come from an allowed server?”
  • DKIM is a wax seal on the letter. Your server signs each email with a secret key. The receiver checks the seal with a public key in your DNS. If the email was changed on the way, the seal breaks.
  • DMARC is your instruction to the receiver: “If a letter fails these checks, here is what to do with it. And please send me a report.”

All three are TXT records, which are simple text notes stored in your DNS.

Step 2: Add an SPF record

Add a TXT record on your main domain (@ or example.com):

v=spf1 ip4:192.0.2.10 include:_spf.mailprovider.example -all

What it means:

  • v=spf1 says “this is an SPF record”.
  • ip4:192.0.2.10 allows your own mail server.
  • include:... allows your email provider’s servers. Your provider tells you the exact value.
  • -all says “nobody else”. Use ~all (a softer “probably not”) while you test.

Important: a domain must have only one SPF record. If you use two services, put both include: parts in the same record.

Step 3: Add a DKIM record

Your email provider creates the key pair for you. You only copy the public key into DNS. It goes on a special name with a selector, which is just a label for the key:

Name:  selector1._domainkey.example.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

The p= part is very long. Copy it exactly, with no extra spaces. Then turn on DKIM signing in your email provider’s settings.

Step 4: Add a DMARC record, starting gently

Add a TXT record on _dmarc.example.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
  • p=none means “do not block anything yet, just report”.
  • rua= is where receivers send daily summary reports.

Why start with none? Maybe you forgot a service that sends email for you, like a newsletter tool or your accounting software. With none, nothing breaks. The reports show you every server sending as your domain.

DMARC also checks alignment. This means the domain in the “From” address must match the domain checked by SPF or DKIM.

Step 5: Check your records

After you save the records, wait a little. DNS changes can take from a few minutes to some hours to spread.

On Mac or Linux, use dig:

dig +short TXT example.com
dig +short TXT selector1._domainkey.example.com
dig +short TXT _dmarc.example.com

On Windows, use nslookup:

nslookup -type=TXT _dmarc.example.com

You can also use any free online SPF/DKIM/DMARC checker. Just type your domain.

The best test is a real email. Send one to a personal mailbox, then open the message details (often called “Show original” or “View source”). Look for a line like this:

Authentication-Results: ... spf=pass ... dkim=pass ... dmarc=pass

Three times “pass” means you are done. 🎉

Step 6: Tighten DMARC over time

Read your DMARC reports for two to four weeks. When every real sender passes, make the policy stronger:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

quarantine sends failing emails to spam. pct=25 applies it to only 25% of failing mail at first. Raise it to 100, then later move to:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Now fake emails using your domain are blocked completely.

Common problems

  • SPF “permerror” → You have two SPF records, or more than 10 DNS lookups. Merge them into one record and remove services you no longer use.
  • DKIM fails → The key was copied with a missing character or extra spaces. Copy it again from your provider.
  • Emails from one tool fail DMARC → That tool sends with its own domain. Add its SPF include and set up DKIM for it in its settings.

Wrap-up

SPF says who may send. DKIM proves the message was not changed. DMARC tells receivers what to do and sends you reports. Together they make your emails trusted, and make it hard for others to pretend to be you.

Next idea: set a monthly reminder to read your DMARC reports. They are the easiest way to spot a new tool sending email without permission.

fsaeed

, , , ,