If someone can send email pretending to be you — using your domain name, your brand — your customers may never know the difference. SPF, DKIM, and DMARC are the three DNS records that stop that from happening. Here's what each one does and why all three matter.
The problem they solve
Email was designed without authentication. By default, anyone can send a message with any "From" address they like. That's why phishing emails so often appear to come from banks, couriers, or trusted businesses. These three standards were created specifically to fix that gap.
SPF — Sender Policy Framework
SPF is a DNS record that lists the servers allowed to send email on behalf of your domain. When an email arrives claiming to be from your domain, the receiving mail server checks your SPF record to see whether the sending server is on the approved list.
If it isn't, the email can be flagged or rejected. Without an SPF record, any server in the world can send email as you.
What a basic SPF record looks like:
v=spf1 include:_spf.google.com ~all
The ~all at the end means "soft fail" anything not on the list. -all is stricter and causes a hard fail.
DKIM — DomainKeys Identified Mail
DKIM adds a cryptographic signature to outgoing emails. Your mail server signs each message with a private key; the recipient's server checks that signature against a public key published in your DNS.
If the email was tampered with in transit, the signature won't match. DKIM proves two things: the email came from your infrastructure, and it wasn't altered after sending.
DMARC — Domain-based Message Authentication, Reporting & Conformance
DMARC is the policy layer that sits on top of SPF and DKIM. It tells receiving mail servers what to do when a message fails those checks: nothing, quarantine it, or reject it outright. It also sends you reports — so you can see who's sending email from your domain.
A basic DMARC record:
v=DMARC1; p=quarantine; rua=mailto:[email protected]
Do you need all three?
Yes. SPF and DKIM alone are not enough — DMARC is what actually enforces the policy and gives you visibility. Many domains have SPF but skip DMARC, which means failures are reported to nobody and nothing gets blocked.
Run a free scan on threatprobe.app to see whether your domain has valid SPF, DKIM, and DMARC records — and whether they're configured correctly. No registration required, results in ~15 seconds.