What are SPF, DKIM, and DMARC, and how do I set up email authentication?

Content & Growing an Audience

What are SPF, DKIM, and DMARC, and how do I set up email authentication?

The short answer

SPF names the servers allowed to send for your domain. DKIM adds a verifiable signature to outgoing messages. DMARC tells receiving systems what to do when authentication and domain alignment fail, and it can send you reports. Set them up through the exact instructions from every service that sends email for you, then verify before enforcing a strict DMARC policy.

The acronyms sound scarier than the job. The dangerous part is guessing at DNS records instead of inventorying your senders first.

Understand the three jobs

  • SPF: A DNS TXT record lists authorized sending systems. Google describes SPF as a way for receiving servers to verify that messages came from authorized servers for the domain.
  • DKIM: Your sending service signs a message with a private key. A public key in DNS lets the receiver verify the signature. Google's DKIM explanation shows this public-key and private-key relationship.
  • DMARC: A policy checks whether SPF or DKIM passes and aligns with the domain visible to the recipient. Google's DMARC setup guide explains that a message passes DMARC when at least one of those methods both authenticates and aligns. The policy can ask receivers to take no action, quarantine failures, or reject them, while reports show who is sending as your domain.

Authentication helps prove where a message came from. It does not excuse an unwanted list or guarantee inbox placement.

Inventory every legitimate sender

Write down every service that sends using your domain: your business inbox, newsletter platform, website forms, appointment tool, store, invoicing system, help desk, CRM, and any developer-managed mail.

Google's SPF setup guide warns that the record should include all authorized senders and should be updated when you add a new one. Missing a quiet system such as a contact form can make legitimate mail fail.

Set up and verify in stages

For each sender, open its current authentication documentation. It should give you the exact DNS record name and value. Add records at the company that hosts your DNS, which may not be the same company that built your website.

Do not paste a sample record from an article into your domain. Do not create several independent SPF records for the same hostname. If more than one service sends mail, follow provider guidance for combining authorizations into the one appropriate SPF policy.

Set up SPF and DKIM first. Send test messages to accounts you control, view the original headers, and confirm that both show the expected result. Then add DMARC with reporting and begin with a monitoring policy. Google's DMARC rollout guidance recommends reviewing reports before gradually moving toward quarantine or rejection.

A strict policy applied too early can block forgotten but legitimate senders. If DNS, email routing, or report interpretation is unfamiliar, ask your email provider or a qualified domain administrator to check the records before enforcement.

Keep a small authentication record

Document the DNS host, purpose, sending service, date added, and person responsible. Review it whenever you change email platforms, checkout tools, or website forms. Remove abandoned services only after confirming they no longer send.

Sources and further reading

A free next step

You don't have to build this alone

Bring your questions, share what you're working on, and meet other women building businesses from home. It is free to join.

Join Our Community Free

Helpful WAHMN article

For a worked example and more help with this topic, read Kit vs. MailerLite for a New Online Business: Which Should You Start With?.

Related Questions

Related WAHMN resource

If email is an important part of your business, this system helps you build the setup, list, messages, and follow-up process around it. See Email Marketing System.

← All questions