What Is SPF, DKIM, and DMARC? A Plain-English Guide for Non-Developers

What is SPF, DKIM, and DMARC in plain English? SPF is the list that says who is allowed to send as yourdomain.com (like a bouncer’s guest list), DKIM is the cryptographic wax seal that proves the message wasn’t altered and is really from you, and DMARC is the instruction to the bouncer that says “if neither the guest list nor the wax seal matches the name on the invitation (From: you@yourdomain.com), quarantine or reject it and send me a report.” You don’t need to code — you just publish three TXT records in your domain’s DNS. Since February 2024, Gmail and Yahoo require all three for bulk senders, and even small senders land in spam without them. This plain-English guide explains what each does (no jargon), how they work together, why they matter for spoofing and deliverability, and how to set them up by clicking in your domain host, not coding.

What Is SPF, DKIM, and DMARC in Plain English? The Bouncer, Seal, and Instruction

Think of every email as an invitation that arrives at a guarded door.

• SPF = The guest list at the door. You publish: “These IPs/hosts are allowed to send as yourdomain.com.” The guard (receiver) checks the envelope’s return address (Return-Path: bounce@mail.esp.net) against your list. If the IP is on the list → SPF pass. If not → fail. This stops random servers from pretending to be you, but it checks the envelope, not the pretty invitation (From: you@yourdomain.com) the recipient sees.
• DKIM = The wax seal on the invitation. Your server stamps the message (headers + body) with a private key; the wax pattern (signature) is inside the header. The guard checks the seal against your public key published in DNS (selector._domainkey.yourdomain.com). If the seal matches and the message wasn’t altered in transit → DKIM pass. This survives forwarding better than SPF because the seal travels with the message, not the IP.
• DMARC = The instruction card you give the guard. You publish at _dmarc.yourdomain.com: “If neither the guest list (SPF) nor the wax seal (DKIM) matches the name on the invitation (From: you@yourdomain.com), then p=none (just watch), p=quarantine (spam), or p=reject (block) — and send reports to rua=mailto:dmarc@yourdomain.com.” DMARC adds the missing piece: alignment to the visible From, and a policy.

Without DMARC, attackers can pass SPF for their own throwaway domain (spf=pass for evil.top) but show From: you@yourdomain.com — the guard sees a pass but doesn’t check that the pass was for the wrong invitation. DMARC fixes that by requiring the pass to match the invitation’s name. That’s why Gmail now requires DMARC for bulk — it’s the only one that ties authentication to what the user actually sees.

Analogy vs Reality — Where It Maps Exactly

What Is SPF? Who May Send as You

SPF is a TXT record at the root of your domain that says “these servers may send mail for me.”

Example for a domain using Google Workspace + SendGrid:

Type: TXT
Host: yourdomain.com
Value: v=spf1 include:_spf.google.com include:sendgrid.net -all
# include:_spf.google.com → allow Google’s IPs
# include:sendgrid.net → allow SendGrid’s IPs
# -all → fail (not softfail ~all) all other IPs → tell receivers to reject

When a receiver gets mail claiming to be from yourdomain.com via IP 192.0.2.1, it looks up your TXT, expands the includes, and checks if 192.0.2.1 is in that set. If yes → spf=pass. If not and you end with -all → spf=fail. Use -all (hard fail) once you’re confident, not ~all (soft fail) forever — soft fail is like a guest list that says “maybe not on list but let them in anyway.” See RFC 7208 and Google SPF Help.

SPF Gotchas Non-Developers Hit

• 10 DNS-lookup limit: Each include: may trigger lookups; if the expanded list needs >10 lookups, SPF returns PermError (treated as fail). You hit this with 4+ includes. Fix: flatten with ip4: ranges or use an SPF flattener tool — don’t just add another include.
• Multiple SPF records: You must have exactly one SPF TXT at the root; two separate TXT records both starting v=spf1 → PermError. Merge into one line.
• SPF checks envelope, not From: Your ESP’s envelope is bounce@mail.sendgrid.net, so SPF can pass for sendgrid.net while visible From is yourdomain.com — DMARC alignment will still fail unless DKIM saves you. That’s why SPF alone never fixes spoofing of the visible From.

What Is DKIM? The Wax Seal That Travels With the Message

DKIM is a cryptographic signature added by your sending server, verified via your public key in DNS — it proves the message is from you and wasn’t altered.

How it works without coding: your admin clicks “Authenticate domain” in Google Workspace/Microsoft 365/SendGrid → the provider gives you a TXT record like selector=mte1 + value k=rsa; p=MIIBIjAN... (long public key) → you paste that TXT at mte1._domainkey.yourdomain.com → the provider starts signing every outgoing mail’s headers+body with the matching private key. Receivers fetch the public key via DNS and check the signature — if it matches, dkim=pass head d=yourdomain.com. Even if the mail is forwarded, the signature (inside the header) travels with it, unlike SPF’s IP check which breaks on forward. See RFC 6376 and Google DKIM Help.

# What you publish (example)
Type: TXT
Host: mte1._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh... (public key)

# What receivers see in header (signed)
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=mte1;
  h=from:to:subject:date; bh=...; b=...
# d=yourdomain.com → domain that signed (must align to From for DMARC)

DKIM Gotchas

• Selector matters: The s= in the signature must match the DNS host you published. If you rotate keys, add the new selector as a second TXT, don’t overwrite the old until mail with old signature ages out.
• DKIM survives forwarding better, but not all modifications: Forwarders that modify the body (add footer) may break the hash → DKIM fail, but DMARC can still pass via SPF alignment if you have it.

What Is DMARC? The Policy That Ties It to What the User Sees

DMARC is a TXT record at _dmarc.yourdomain.com that says “my visible From is yourdomain.com — only trust SPF or DKIM that aligns to that name, and here’s what to do if neither aligns.”

Type: TXT
Host: _dmarc.yourdomain.com
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s
# p=quarantine → spam if fail (start p=none → quarantine → reject)
# rua → where aggregate reports go (daily XML)
# pct → percent to apply policy to (100 = all)

On receipt, the server checks: does SPF align (envelope domain matches From domain?) OR does DKIM align (d= matches From domain?)? If either aligns and passes → dmarc=pass. If neither aligns → dmarc=fail → apply p=. This “either/or aligned” is why you need at least one of SPF or DKIM to be correctly aligned — SPF alone fails when you use an ESP (envelope is ESP’s), but DKIM with d=yourdomain.com saves you. See RFC 7489 + Google DMARC Help + Microsoft Email Authentication.

DMARC Policies — None → Quarantine → Reject (The Staircase)

Start at p=none (monitor: deliver but report), then p=quarantine (spam), then p=reject (block). Jumping straight to p=reject without monitoring can block your own legitimate mail if SPF/DKIM are misaligned — the reports at rua= tell you what’s failing before you enforce. Keep pct=100 once confident, or use pct=25 to test on a sample.

How They Work Together — The Alignment That Actually Stops Spoofing

SPF checks the envelope, DKIM checks the seal, DMARC checks the invitation — only DMARC requires the check to match the name the user sees.

The takeaway for non-developers: publish SPF for your senders, but don’t rely on it alone when you use an ESP — you must publish DKIM for yourdomain.com in that ESP so at least one path aligns. That’s the 2024 Gmail requirement in one line.

Why They Matter — Spoofing, Spam Placement, and the 2024 Bulk Rules

Without these three, anyone can send as you@yourdomain.com and some receivers will deliver it — with them, spoofing is quarantined before the inbox.

• Spoofing: Without DMARC p=reject, attackers can send From: ceo@yourdomain.com and some of your own employees will see it as internal — that’s how BEC (business email compromise) starts.
• Deliverability: Since Feb 2024, Gmail/Yahoo bulk senders (>5k/day to Gmail) must have SPF + DKIM + DMARC aligned + one-click unsubscribe + <0.3% spam rate, or mail is rejected. Even small senders are filtered harder without them — Postmaster Tools shows the penalty. See Google SPF + Google DMARC.
• Reporting: DMARC rua= sends daily XML reports showing who sent as you (including unauthorized) and whether they passed — the only way to see spoof attempts you didn’t know about.

How to Check If You Have Them (No Coding, 5 Minutes)

Use the same tools receivers use — DNS lookup + header check + Postmaster.

1. DNS lookup (authoritative): In terminal or MXToolbox SuperTool → dig TXT yourdomain.com should show v=spf1 ... -all; dig TXT selector._domainkey.yourdomain.com should show k=rsa; p=...; dig TXT _dmarc.yourdomain.com should show v=DMARC1; p=quarantine; rua=.... No record = not published.
2. Gmail Show original (per message): Open a mail you sent to a Gmail address → ⋮ → Show original → top shows SPF, DKIM, DMARC: pass and mailed-by: yourdomain.com + signed-by: yourdomain.com aligned. If any fail, it’s DNS; if all pass but still spam, it’s reputation/content.
3. Postmaster + mail-tester: Add domain to Postmaster Tools → check Authentication pass % and spam rate; send a test to mail-tester.com → score 10/10 with SPF/DKIM/DMARC green.

From: Weekly Nerd <hello@toolwasp.com>
Return-Path: <bounce@mg.toolwasp.com>
Authentication-Results: mx.google.com;
  spf=pass (domain of bounce@mg.toolwasp.com designates 192.0.2.5 as permitted)
  dkim=pass header.d=toolwasp.com
  dmarc=pass (p=quarantine) header.from=toolwasp.com  ← aligned!

How to Set Them Up Without Coding — Click in Your Domain Host

You don’t write code — you paste three TXT records where your domain’s DNS lives (Cloudflare, GoDaddy, Namecheap, Google Domains).

Step 1: SPF — List Who May Send (10 min)

In your DNS host → Add record → Type TXT → Host @ (root) → Value v=spf1 include:_spf.google.com include:sendgrid.net -all (replace with your senders: Google Workspace + your ESP). Include every provider that sends as you — if you also use Mailchimp, add include:servers.mcsv.net. Keep one SPF record total and ≤10 lookups — flatten with ip4: if needed. See Google SPF.

Step 2: DKIM — Add the Wax Seal (10 min, per provider)

In your sending provider → Authenticate domain → it gives you Host mte1._domainkey + Value v=DKIM1; k=rsa; p=MIIBIjAN... → paste that TXT in DNS → click Verify in the provider. Do this for each provider (Google Workspace + SendGrid = two DKIM records with different selectors). Wait for propagation (dig TXT mte1._domainkey.yourdomain.com should return the key), then send a test mail → Show original should now show dkim=pass head d=yourdomain.com. See Google DKIM.

Step 3: DMARC — Tell Receivers What to Do (5 min, then watch)

Add TXT → Host _dmarc → Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100 → Save. This is monitor mode — you’ll get daily reports at dmarc@yourdomain.com showing who sent as you. After a week of green reports (SPF or DKIM aligned for your legitimate senders), raise to p=quarantine, then p=reject — this tells receivers to block spoofs. See Google DMARC + Microsoft Email Authentication. Explore more at Toolwasp.

Common Mistakes Non-Developers Make (And the 2-Minute Fix)

Practice Lab — Publish and Prove in 10 Minutes

Lab — on your test domain:

1) Check now: dig TXT yourdomain.com → look for v=spf1
   dig TXT mte1._domainkey.yourdomain.com → look for v=DKIM1
   dig TXT _dmarc.yourdomain.com → look for v=DMARC1
2) Publish SPF: TXT @ → v=spf1 include:_spf.google.com -all  (adjust for your ESP)
3) Publish DKIM: add TXT from provider → verify with dig
4) Publish DMARC: TXT _dmarc → v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
5) Send test to Gmail → Show original → spf/dkim/dmarc pass aligned? → then raise p to quarantine

You just went from no auth → monitored → enforced — the exact staircase.

Frequently Asked Questions

What does SPF actually check?

SPF checks whether the sending IP is on your domain’s guest list (the TXT at your root). It checks the envelope Return-Path, not the visible From — that’s why SPF alone can pass for the wrong domain. See RFC 7208 and Google SPF.

What does DKIM actually prove?

DKIM proves the message was signed by a holder of your private key and wasn’t altered in transit — the wax seal. Receivers verify via your public key at selector._domainkey. It travels with the message, so forwarding doesn’t break it like SPF. See RFC 6376.

What does DMARC do that SPF and DKIM don’t?

DMARC ties authentication to the visible From (alignment) and tells receivers what to do on fail (quarantine/reject) plus where to send reports. SPF/DKIM alone can pass for the wrong domain; DMARC fails unless the pass aligns to From. See RFC 7489 and Cloudflare.

Do I need all three?

Yes — for deliverability and spoof protection. Since Feb 2024, Gmail/Yahoo bulk senders must have all three aligned. Even small senders are filtered harder without them. Publish SPF + DKIM for yourdomain.com in each ESP, then DMARC p=quarantine → reject. That’s the 2024 baseline per Google DMARC.

Can I have multiple SPF records?

No — exactly one SPF TXT at the root. Two separate TXT records both starting v=spf1 cause PermError (fail). Merge all includes into one line: v=spf1 include:_spf.google.com include:sendgrid.net -all.

Why does my SPF still fail after I added it?

Usually >10 DNS lookups (too many includes), a typo in the TXT, or you pasted it at www.yourdomain.com instead of root yourdomain.com. Check dig TXT yourdomain.com and count includes — flatten with ip4: if over. See RFC 7208.

How long does DMARC take to work?

DNS propagation is minutes to hours; reports arrive daily at your rua= mailbox. Start at p=none for a week to collect reports, then move to p=quarantine, then p=reject after another week green. No code — just TXT updates and monitoring.

Will SPF/DKIM/DMARC stop all spam going to spam?

They stop spoofing and help deliverability, but spam placement also depends on reputation (spam rate <0.3%), list hygiene, and content. With auth green but 5% bounces, you’ll still land in spam — fix list and keep spam rate <0.1% via Postmaster Tools as well. See Microsoft.

Last updated: September 3, 2026 • Author: Toolwasp Team • Sources verified Sep 3, 2026: RFC 7208 SPF, RFC 6376 DKIM, RFC 7489 DMARC, Cloudflare SPF/DKIM/DMARC, Google SPF, Google DKIM, Google DMARC, Microsoft Email Authentication. More plain-English guides at Toolwasp.