Email authentication: SPF, DKIM and DMARC
Email authentication is a set of three DNS records, SPF, DKIM and DMARC, that together let a receiving server verify an email genuinely came from the domain it claims.
Also called SPF, DKIM, DMARC.
Email authentication is how a receiving server checks that a message claiming to be from your domain really is. It rests on three DNS records that do different jobs, and it works only when all three are present.
SPF, the Sender Policy Framework, is a list of the servers allowed to send mail for your domain. The receiver compares the sending server against that list. It breaks on forwarding, because a forwarded message arrives from a server your record never named.
DKIM, DomainKeys Identified Mail, attaches a cryptographic signature to each message using a private key, which the receiver verifies against a public key in your DNS. It proves the message was authorised by the domain and was not altered on the way, and unlike SPF it survives forwarding.
DMARC ties the two together and is the part most senders skip. It tells receivers what to do when a message fails both checks, and it requires alignment: the domain in the visible From address has to match the domain that passed SPF or DKIM. Without DMARC, an attacker can pass SPF for their own domain while showing your name in the From field. Since 2024, Google and Yahoo require DMARC on any domain sending meaningful volume, so it is no longer optional in practice.
In practice
- An SPF record: v=spf1 include:_spf.google.com ~all
- A DMARC record starting at monitoring only: v=DMARC1; p=none; rua=mailto:dmarc@example.com
- The same record after a month of clean reports: v=DMARC1; p=reject
Questions
Do I need all three, or is SPF enough?
All three. SPF alone fails on any forwarded message and does nothing about the From address a recipient actually reads, which is the field that gets spoofed. DKIM alone proves authorisation but tells receivers nothing about what to do with failures. DMARC is what makes the other two enforceable, and it is what Google and Yahoo now check on domains sending at volume.
Should I set DMARC to reject straight away?
No. Start at p=none, which asks receivers to report failures without acting on them, and read the reports for a few weeks. Almost every organisation discovers a legitimate sender it had forgotten about, such as a billing system or a help desk, that is not covered by its SPF or DKIM setup. Moving to p=reject before finding those means silently destroying your own mail.
Does authentication get me into the inbox?
No, it gets you considered. Authentication is a precondition rather than an advantage: failing it is close to fatal, and passing it earns you nothing except the chance to be judged on your sending history and how recipients respond. It is table stakes, not a lever.
From the blog
Related terms
Last updated