SPF vs DKIM vs DMARC: What They Are and How They Work Together | InboxVerify
Guide

SPF, DKIM and DMARC explained

A plain-language explanation of SPF, DKIM and DMARC, how they work together, example records, and the order to set them up in.

Updated October 12, 2026 · 7 min read · By the InboxVerify team

SPF, DKIM and DMARC are three DNS records that prove an email really comes from your domain. Together they stop spoofing and are now required by Gmail and Yahoo for anyone sending in bulk.

SPF — which servers may send

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers and services allowed to send email for it. The receiver checks the connecting IP against that list.

TXT · @
v=spf1 include:_spf.google.com include:sendgrid.net ~all
  • Checks the envelope sender (Return-Path), not the visible From
  • One record per domain, maximum 10 DNS lookups
  • Breaks when mail is forwarded

DKIM — a signature on every message

DKIM (DomainKeys Identified Mail) signs each message with a private key. The public key is published in DNS at selector._domainkey.yourdomain. The receiver verifies the signature, which proves the message was not altered and was authorised by the signing domain.

TXT · google._domainkey
v=DKIM1; k=rsa; p=MIIBIjANBgkqh…
  • Survives forwarding (as long as the message is not modified)
  • Each sending service has its own selector
  • Use 2048-bit RSA keys

DMARC — the policy and the reports

DMARC ties SPF and DKIM to the domain people actually see in the From address (alignment), tells receivers what to do when both fail, and sends you daily reports about who is sending as your domain.

TXT · _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
  • p=none monitor, p=quarantine spam folder, p=reject block
  • A message passes DMARC if SPF or DKIM passes and aligns with the From domain
  • Reports (rua) show every source sending as you

How they work together

  1. The receiver checks SPF for the sending IP
  2. It verifies the DKIM signature
  3. DMARC checks whether at least one of them passed for the same domain as the From address
  4. If not, it applies your policy and records the result in your reports

The right order to set them up

  1. SPF with every sending service
  2. DKIM in every sending service
  3. DMARC at p=none with a reporting address
  4. Read reports for 2–4 weeks and fix unknown senders
  5. Move to p=quarantine, then p=reject
Domain CheckerSee which of the three your domain already has — and what is wrong — in one report.
Open Domain Checker →

Frequently asked questions

Do I need all three?

Yes. SPF and DKIM authenticate; DMARC makes the result count for your visible From domain and protects it from spoofing.

Which is most important?

DKIM is the most robust because it survives forwarding, but DMARC requires at least one aligned pass, so set up all three.

Can SPF, DKIM or DMARC break my email?

A wrong SPF record or a strict DMARC policy before all senders are authenticated can cause rejections. Start DMARC with p=none.