SPF, DKIM and DMARC Explained (Gmail & Yahoo Rules)

Email was designed without any way to prove who sent a message. Anyone can put your domain in the "From" line. Three DNS-published standards fix that: SPF says which servers may send for your domain, DKIM lets you sign messages, and DMARC ties the two to the address people actually see and tells receivers what to do when checks fail.

SPF: which servers may send

SPF (RFC 7208) is a single TXT record on your domain listing the servers allowed to send mail for it:

example.com.  TXT  "v=spf1 include:_spf.google.com ip4:192.0.2.0/24 ~all"

The receiving server takes the address in the message's envelope (the return path, not the visible From), looks up that domain's SPF record, and checks whether the connecting IP address is allowed. The all at the end says what happens otherwise: -all fail, ~all soft fail, ?all neutral.

SPF has two well-known weaknesses. It checks the envelope address, which the reader never sees. And it breaks when mail is forwarded, because the forwarding server isn't on your list.

DKIM: a signature on each message

With DKIM (RFC 6376), your mail server signs each outgoing message with a private key. The public key is published in DNS under a selector:

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

The signature header in each message names the domain (d=) and the selector (s=), so the receiver knows where to find the key. Because the signature travels with the message, DKIM usually survives forwarding. Use 2048-bit RSA keys; 1024-bit keys are considered weak.

Selectors are chosen by your mail provider and DNS cannot list them. To check a key, look for s= in the DKIM-Signature header of a message you sent.

DMARC: alignment and policy

Neither SPF nor DKIM looks at the From address the reader sees. A spammer can pass SPF for their own domain while putting yours in From. DMARC (RFC 7489) closes that gap with alignment: a message passes DMARC only if SPF or DKIM passes for a domain that matches the visible From domain.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

• p is the policy for failing mail: none (deliver, just report), quarantine (spam folder) or reject.
• rua is where receivers send daily aggregate reports listing every source that sent mail as your domain, and whether it passed.
• adkim and aspf choose relaxed alignment (subdomains count as a match, the default) or strict.

The reports are the most useful part. They show third-party services sending on your behalf that you may have forgotten about—billing systems, CRMs, newsletter tools—before you start enforcing.

How receivers combine them

1. Check SPF for the envelope domain, and DKIM for each signature.
2. See whether either passing result is aligned with the From domain.
3. If neither is aligned and passing, DMARC fails. Apply the domain's p= policy.
4. Record the result for the aggregate report.

DMARC passing doesn't guarantee the inbox—spam filtering still looks at content and reputation—but failing it increasingly guarantees the opposite.

What mailbox providers require

Since February 2024, Gmail and Yahoo require anyone sending them bulk mail (around 5,000 messages a day or more) to have SPF and DKIM, a DMARC record (at least p=none), and alignment. Microsoft introduced similar requirements for Outlook.com in 2025. Even small senders need at least SPF or DKIM. In practice, all three are now table stakes.

Domains that don't send mail

Parked and unused domains are attractive for spoofing precisely because nobody watches them. Lock them down with:

example.com.         MX   0 .
example.com.         TXT  "v=spf1 -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject"

Check your domain

The Email Authentication Checker validates your SPF record (including every include), DMARC policy and reporting, and DKIM keys at your selector. If SPF is over its limit, see fixing SPF "too many DNS lookups".