SPF, DKIM, and DMARC are the three DNS-based standards that prove to receiving mail servers that your email is legitimate. Together they make up domain authentication, the proof that a message really comes from the domain it claims. Without all three configured correctly, your domain is vulnerable to spoofing and ISPs will treat your email with increased suspicion, and increasingly, reject it outright.
DMARC adoption has surged: according to the Validity 2025 Email Deliverability Benchmark Report, global DMARC implementation among active sending domains jumped significantly between 2023 and 2025, driven almost entirely by enforcement: Gmail, Yahoo, Microsoft Outlook, and La Poste now all require DMARC for bulk senders.
Authentication by the Numbers
SPF vs DKIM vs DMARC at a glance
Each record answers a different question, and DMARC is the only one that sets a policy.
| SPF | DKIM | DMARC | |
|---|---|---|---|
| Question it answers | Is this server allowed to send for the domain? | Was this message signed with the domain’s key and left unaltered? | Do SPF or DKIM align with the From domain, and what happens if not? |
| Where it lives | TXT record at your domain | TXT record at a selector under _domainkey |
TXT record at _dmarc.yourdomain.com |
| Common failure | More than 10 DNS lookups | Selector in DNS does not match the one your ESP signs with | No record, or a policy stuck at p=none |
SPF: Sender Policy Framework
SPF is a DNS record that lists every IP address and domain service authorized to send mail on your behalf.
How It Works
- You publish a TXT record at your domain:
v=spf1 include:your-esp.com ~all - When Gmail receives an email claiming to be from you, it checks if the sending IP is in your SPF record
- If it matches, SPF passes. If not, the
~all(softfail) or-all(hardfail) policy kicks in
Common Mistakes
- Exceeding 10 DNS lookups: SPF limits you to 10 lookups. Tools like SPF flattening help reduce this count.
- Missing ESPs: Added a new email tool? Update your SPF record.
- Wrong qualifier: Start with
~all(softfail) before switching to-all(hardfail)
DKIM: DomainKeys Identified Mail
DKIM adds a digital signature to every email you send, proving the content wasn’t modified in transit.
How It Works
- Your email provider generates a public/private key pair
- The private key signs every outgoing email’s headers
- You publish the public key as a DNS TXT record
- Receiving servers verify the signature using your public key
Why It Matters
DKIM is required for DMARC alignment. Without it, your DMARC policy is based only on SPF, which is weaker and doesn’t authenticate the visible From address.
DMARC: Domain-based Message Authentication, Reporting & Conformance
DMARC is the policy layer that ties SPF and DKIM together and provides reporting.
The Three Policies
| Policy | Effect |
|---|---|
p=none |
Monitor only, no action taken on failures |
p=quarantine |
Failed messages go to spam |
p=reject |
Receivers are asked to reject failed messages (they may still deliver or junk them) |
Start with Monitoring
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comThis gives you visibility into all mail streams claiming to be from your domain before you enforce anything.
Reading DMARC Reports
DMARC reports (RUA = aggregate, RUF = forensic) are XML files that tell you:
- Which IPs are sending mail as your domain
- Whether SPF and DKIM are passing
- How many messages are failing
InboxEagle’s separate paid DMARC Processing product ingests and processes these reports at volume so you don’t have to read raw XML. The base plan checks your DMARC policy record every 24 hours and alerts on change.
DMARCbis: The 2026 Spec Update
In May 2026, the IETF published a revised DMARC specification, RFC 9989, known as DMARCbis, obsoleting the 2015-era RFC 7489. Existing records stay valid and keep using v=DMARC1, so there’s no migration to do, but three changes affect what you publish from here on:
pct,rf, andriare removed. Receivers applied the percentage tag inconsistently, and too many senders parked at a partialpctvalue instead of treating it as a ramp to full enforcement. If your record still haspct=, it isn’t broken, it just references a tag the current standard no longer defines (the newttag replacespct).npis new. It sets policy for subdomains that don’t exist, closing a spoofing gap thatspalone left open. Addnp=rejectthe next time you touch your record.- The Public Suffix List is out. Receivers now find the organizational domain with a DNS tree walk instead of relying on the externally maintained PSL.
Enforcement Timeline: Where This Is Mandatory
Authentication started as a best practice. It’s now a requirement enforced at the SMTP level across major providers:
| Provider | Enforcement Began | What Happens to Non-Compliant Mail |
|---|---|---|
| Gmail | February 2024 (filtering) → November 2025 (SMTP rejection) | Rejected with permanent error codes, never reaches Gmail servers |
| Yahoo Mail | February 2024 | Rejected or filtered |
| Microsoft Outlook / Hotmail / Live | May 5, 2025 | Rejected with error 550 5.7.515 |
| La Poste | September 2025 | Rejected |
If you’re sending bulk email (5,000+ per day) to any of these providers without DMARC, your mail is being rejected. Not filtered, rejected. The era of “it’s recommended but optional” ended in 2024.
What Comes After DMARC: BIMI
Once you have DMARC at p=quarantine or p=reject, you can implement BIMI to display your brand logo in Gmail, Yahoo, and Apple Mail inboxes, a visibility feature senders report correlates with up to 39% higher open rates. BIMI requires an SVG logo file and a certificate asserting logo ownership. Google’s 2025 Common Mark Certificate (CMC) removed the trademark registration requirement, making it accessible for most brands with at least one year of logo use. For the full implementation sequence and certificate options, see BIMI in 2026: Google’s CMC Makes Brand Logos Affordable.
Looking further ahead, the DKIM half of this trinity is itself being overhauled: the IETF is drafting DKIM2 to close DKIM’s replay-attack, broken-forwarding, and bounce-routing gaps with a signed chain of custody. It’s not a standard yet and requires no new records today. See What Is DKIM2? for what’s coming and how to prepare.
Before You Configure: Choose the Right Sending Domain
One decision that affects all three records is whether you are configuring authentication on your root domain or a sending subdomain. Configuring on a subdomain like mail.yourbrand.com keeps your email reputation isolated from your website domain and gives you a cleaner DNS namespace for your DKIM and Return-Path records. How to set up a subdomain strategy for email sending covers how to structure this before you start adding records.
How to verify SPF and DKIM
To verify SPF and DKIM on a live message, open it in Gmail, choose Show original, and look for spf=pass and dkim=pass with the domain you expect. To verify them before sending, run the domain through the free SPF record checker and DKIM record checker. Then confirm DMARC with the DMARC record checker, since a pass on both SPF and DKIM can still fail DMARC if neither aligns with your From domain.
The Correct Implementation Order
Follow the steps above in sequence: SPF first, then DKIM, then DMARC. This order protects you from accidentally blocking legitimate email during rollout.
The Bottom Line
Authentication is not optional in 2026: it’s enforced at the SMTP level by Gmail, Yahoo, Microsoft Outlook, and La Poste. Without all three, your mail is being rejected before anyone has a chance to read it.
- SPF first, then DKIM, then DMARC. Never skip steps or implement in a different order
- Start DMARC at p=none. Monitor for 2-4 weeks before moving to p=quarantine
- 100% authentication pass rate is the target. Anything below that means some legitimate mail is failing
- DMARC reports are your intelligence feed. Set up rua= reporting and read it; it shows unauthorized senders using your domain
- p=reject unlocks BIMI. Brand logo display in Gmail and Yahoo requires DMARC enforcement
Need to build your records? Try the free DMARC Record Generator or SPF Builder, no account required. Want to see how different DMARC checker tools stack up before picking one? We compared 7 of them. Once your records are live, DMARC Monitoring from InboxEagle checks your DMARC policy record every 24 hours and alerts you when it changes.
Set this up in InboxEagle
For a complete step-by-step walkthrough in InboxEagle, including how to verify each record and advance your DMARC policy, see Authenticate your sending domain. To troubleshoot failures, see Fix DMARC failures.