Guide
Set up your email so it arrives and can't be faked
SPF, DKIM and DMARC in plain words. What each one does, how to check yours, and the order to set them up in.
If your organization sends email from its own domain, three DNS records decide two things: whether your mail reaches people's inboxes, and whether someone else can send mail that looks like it came from you. Gmail and Yahoo began requiring them of bulk senders in 2024, and most other providers treat mail without them with suspicion.
SPF: who may send for you
SPF is one DNS record that lists the services allowed to send mail for your domain. If you use Google Workspace, it includes Google's servers. If you also send through a newsletter tool or a donation platform, it needs those too.
A domain has one SPF record, not one per service. Two records break both.
DKIM: a signature on every message
DKIM signs each message your provider sends with a key only it holds. The matching public key goes in your DNS, so a receiving server can check that the message is really yours and wasn't changed on the way. You turn it on in your email provider's admin settings, and it gives you the record to add.
DMARC: what to do when a check fails
DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports about it. Start by only watching: a policy of none changes nothing but sends you reports. Once the reports show only your own services sending, move to quarantine, then reject.
The order to do it in
- Add or fix your SPF record, with every service that sends for you.
- Turn on DKIM with your email provider.
- Add a DMARC record with a policy of
none, and read the reports for a few weeks. - Tighten the policy once the reports are clean.
Our free site health check looks at all three and tells you what it found.
Follow along
Read the next one
We write about what we're building and learning. Get it by email, or wherever you already read.
Purposeful software for meaningful work.