SPF, DKIM, and DMARC are the three DNS-based standards that prove to receiving mail servers that your email is legitimate. Without all three configured correctly, your domain is vulnerable to spoofing and ISPs will treat your email with increased suspicion. As of February 2024, Gmail and Yahoo require DMARC authentication for all senders sending 5,000+ emails per day.
Over a decade of diagnosing deliverability failures across thousands of email programs, authentication misconfiguration is consistently the first thing we find — and the fastest thing to fix.
Authentication by the Numbers
SPF: Sender Policy Framework
SPF is a DNS record that lists every IP address and domain service authorized to send mail on your behalf.
How It Works
- You publish a TXT record at your domain:
v=spf1 include:bayengage.com ~all - When Gmail receives an email claiming to be from you, it checks if the sending IP is in your SPF record
- If it matches, SPF passes. If not, the
~all(softfail) or-all(hardfail) policy kicks in
Common Mistakes
- Exceeding 10 DNS lookups: SPF limits you to 10 lookups. Tools like SPF flattening help reduce this count.
- Missing ESPs: Added a new email tool? Update your SPF record.
- Wrong qualifier: Start with
~all(softfail) before switching to-all(hardfail)
DKIM: DomainKeys Identified Mail
DKIM adds a digital signature to every email you send, proving the content wasn’t modified in transit.
How It Works
- Your email provider generates a public/private key pair
- The private key signs every outgoing email’s headers
- You publish the public key as a DNS TXT record
- Receiving servers verify the signature using your public key
Why It Matters
DKIM is required for DMARC alignment. Without it, your DMARC policy is based only on SPF, which is weaker and doesn’t authenticate the visible From address.
DMARC: Domain-based Message Authentication, Reporting & Conformance
DMARC is the policy layer that ties SPF and DKIM together and provides reporting.
The Three Policies
| Policy | Effect |
|---|---|
p=none | Monitor only — no action taken on failures |
p=quarantine | Failed messages go to spam |
p=reject | Failed messages are blocked entirely |
Start with Monitoring
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comThis gives you visibility into all mail streams claiming to be from your domain before you enforce anything.
Reading DMARC Reports
DMARC reports (RUA = aggregate, RUF = forensic) are XML files that tell you:
- Which IPs are sending mail as your domain
- Whether SPF and DKIM are passing
- How many messages are failing
InboxEagle parses and visualizes these reports so you don’t have to read raw XML.
The Correct Implementation Order
Follow the steps above in sequence — SPF first, then DKIM, then DMARC. This order protects you from accidentally blocking legitimate email during rollout.
Need to build your records? Try the free DMARC Record Generator or SPF Builder — no account required. Once your records are live, DMARC Monitoring from InboxEagle continuously tracks enforcement rates and alerts you to failures in under 2 minutes.