SPF / DKIM / DMARC

SPF, DKIM, and DMARC are email authentication protocols that prove your emails are legitimate and not forged or spoofed. They are required by Gmail and Yahoo as of 2024, and essential for email deliverability and brand protection.

Category: Marketing Automation (also: Architecture, Security)

Author: Atomic Glue Editorial Team

## Definition

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-Based Message Authentication, Reporting, and Conformance) are three DNS-based email authentication protocols that work together to prevent email spoofing, phishing, and unauthorized use of your sending domain. **SPF** specifies which mail servers are authorized to send email on behalf of your domain. **DKIM** attaches a cryptographic signature to each email that recipients can verify against your domain's DNS records. **DMARC** tells receiving mail servers what to do if an email fails SPF or DKIM checks (do nothing, quarantine, or reject) and provides reporting on authentication failures. Together, these protocols protect your brand from impersonation, improve deliverability, and are now mandatory for reaching Gmail and Yahoo recipients.

## SPF: Sender Policy Framework

SPF is a DNS TXT record that lists every server authorized to send email from your domain. When a receiving mail server gets an email claiming to be from yourdomain.com, it checks the SPF record to verify the sending server is on the list. If not, the email may be rejected or flagged. SPF records include IP addresses and third-party senders (like HubSpot, Salesforce, Mailchimp). A common mistake is omitting third-party senders, which causes legitimate marketing emails to fail SPF checks. SPF has limitations: it only checks the envelope sender (Return-Path), not the visible From address, which means it can be bypassed by certain spoofing techniques.

## DKIM: DomainKeys Identified Mail

DKIM adds a digital signature to every outgoing email. The signature is generated using a private key stored on your sending server. The corresponding public key is published in your DNS as a TXT record. When a receiving server gets your email, it retrieves the public key from your DNS and verifies the signature. If the signature matches, the email is authenticated and has not been tampered with in transit. DKIM is more secure than SPF because the signature is cryptographically tied to the email content. Each email-sending platform (HubSpot, Google Workspace, Mailchimp) generates its own DKIM key pair. You publish the public key in your DNS.

## DMARC: Domain-Based Message Authentication

DMARC ties SPF and DKIM together and tells receiving mail servers what to do when authentication fails. A DMARC policy is published as a DNS TXT record and specifies: the policy for failed emails (p=none, p=quarantine, or p=reject), an email address for receiving aggregate reports about authentication failures (rua), and an email address for receiving forensic failure reports (ruf). DMARC also requires alignment: the domain in the From address must match the domain authenticated by SPF or DKIM. Start with p=none to monitor authentication without blocking legitimate email. Move to p=quarantine once you confirm SPF and DKIM are correctly configured. Only move to p=reject when you are confident all legitimate email is properly authenticated.

## Implementation and Maintenance

Set up SPF first, then DKIM, then DMARC. Use DMARC reporting tools (like DMARC Analyzer, Valimail, or Postmark) to monitor authentication results. When you add a new email-sending service, update your SPF record and add their DKIM key. In 2024, Gmail and Yahoo made DMARC enforcement with at least p=none mandatory for bulk senders (sending over 5,000 emails per day). Google and Yahoo also require SPF or DKIM for all senders. Failure to implement these protocols will result in email rejection or spam placement.

## Note

SPF has a 10-DNS-lookup limit. If you have too many third-party senders, you may hit this limit and cause SPF failures. Use SPF flattening tools or consolidate senders to stay under the limit. DMARC p=reject should only be implemented after weeks or months of monitoring with p=none to avoid blocking legitimate email.

## In code

Example DNS TXT Records

; SPF Record (TXT)
yourdomain.com.  IN  TXT  "v=spf1 include:_spf.google.com include:spf.hubspot.com ~all"

; DKIM Record (TXT - example for Google Workspace)
google._domainkey.yourdomain.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCI..."

; DMARC Record (TXT)
_dmarc.yourdomain.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

## Common questions

Q: What happens if I do not set up SPF, DKIM, and DMARC?

A: As of 2024, Gmail and Yahoo require at least SPF or DKIM for all senders and DMARC for bulk senders. Without them, your emails may be rejected or marked as spam. You are also vulnerable to domain spoofing where attackers send email appearing to be from your company.

Q: Which one should I set up first?

A: SPF first, then DKIM, then DMARC. Each builds on the previous one. Test at each step before moving to the next.

Q: Do I need all three?

A: Yes, for full protection and optimal deliverability. SPF and DKIM authenticate your email. DMARC tells receivers what to do when authentication fails and provides critical reporting. SPF or DKIM alone is not enough.

## Key takeaways

• SPF lists authorized sending servers for your domain.
• DKIM provides cryptographic verification that email has not been tampered with.
• DMARC sets policy for authentication failures and enables reporting.
• All three are required for Gmail and Yahoo deliverability as of 2024.
• Implement in order: SPF first, DKIM second, DMARC last. Start DMARC with p=none.

## Related entries

• [Email Marketing](atomicglue.co/glossary/email-marketing)
• [Open Rate / Deliverability](atomicglue.co/glossary/open-rate-deliverability)
• [Email Automation / Drip Campaign](atomicglue.co/glossary/email-automation-drip-campaign)

Last updated July 2026. Permalink: atomicglue.co/glossary/spf-dkim-dmarc