SPF, DKIM and DMARC, explained without the jargon

Three DNS records stand between your email and the spam folder. Most guides explain the acronyms and skip what they mean. Here is the short version.

SPF says which servers may send

SPF is a list of servers allowed to send mail for your domain. It lives in a TXT record on the domain itself:

v=spf1 include:amazonses.com ~all

include:amazonses.com delegates to Amazon's own list. ~all means "anything else is suspicious" — a soft fail. Use -all (hard fail) only once you are certain every legitimate sender is listed, because anything you forget stops being delivered.

The catch nobody mentions: SPF checks the envelope sender, not the From: address your recipient sees. Forwarded mail usually breaks SPF, which is why it cannot be the only thing you rely on.

There is also a hard limit of ten DNS lookups. Each include: counts. Chain enough providers together and SPF silently stops evaluating — a permanent error that looks exactly like a misconfiguration.

DKIM proves the message was not altered

DKIM signs each message with a private key. Receivers fetch the matching public key from your DNS and verify the signature. If the body or the signed headers were changed in transit, verification fails.

Unlike SPF, DKIM survives forwarding, because the signature travels with the message.

You publish it as CNAME records pointing at your provider, which is what lets them rotate keys without you touching DNS again:

abc123._domainkey  CNAME  abc123.dkim.amazonses.com

DMARC ties the two together

SPF and DKIM each validate something the recipient cannot see. DMARC connects them to the From: address that is actually displayed, and tells receivers what to do when neither passes.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none means "do not change anything, but send me reports". Start there. Read the reports for a few weeks, confirm every legitimate sender authenticates, then move to p=quarantine and eventually p=reject.

Publishing p=reject before you know what sends as your domain is the single most common way to break your own invoices, password resets and internal notifications overnight.

The order that works

1. SPF, so your sending service is authorised.
2. DKIM, so messages verify after forwarding.
3. DMARC at p=none, so you get visibility without risk.
4. Read reports until nothing unexpected appears.
5. Tighten to quarantine, then reject.

Since February 2024, Gmail and Yahoo require all three from anyone sending bulk mail. This is no longer optional hygiene — it is the entry requirement.