Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

What are SPF, DKIM, and DMARC and do we need all three?

The three DNS records that prove your email is really from you. Yes, you need all three.

SPF lists which servers may send mail for your domain. DKIM adds a cryptographic signature proving a message was not altered. DMARC ties them to the address recipients see and tells mailbox providers what to do when a message fails. Yes, you need all three.

What each one does

  • SPF, defined in RFC 7208, is a DNS record listing the servers authorized to send for your domain. A receiving server checks the sending IP against that list. If you add a new sending tool and forget to update SPF, that tool's mail starts failing.
  • DKIM, defined in RFC 6376, signs outgoing messages with a private key and publishes the public key in DNS. The receiver verifies the signature, which proves the message really came from your domain and was not modified in transit. Google notes that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommends 2048 bits.
  • DMARC, originally RFC 7489 and now specified in RFC 9989, sits on top. It requires that the domain in the visible From address lines up with the SPF or DKIM domain, and it publishes a policy telling receivers what to do when that fails: none, quarantine, or reject.

Why you no longer get to skip one

Google's email sender guidelines require SPF or DKIM from all senders, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages per day to Gmail accounts, with the From domain aligned to SPF or DKIM. Yahoo's sender best practices require SPF or DKIM from every sender, and both plus a valid DMARC policy of at least p=none from bulk senders. Both also require valid forward and reverse DNS for your sending IPs.

Start DMARC at monitoring

Publish DMARC with p=none first, and include a rua tag so you receive aggregate reports. Yahoo specifically recommends the rua tag for monitoring during setup. Read those reports for several weeks, find every legitimate sender you forgot about, the invoicing system, the scheduling tool, the HR platform, and get each one authenticated. Only then move to quarantine, then to reject. Going straight to reject is how a company stops its own invoices from being delivered.

Who actually does this

This is DNS work, so it usually needs whoever controls your domain registrar, often IT or the person who built the website. Your email platform will generate the records to publish. In HubSpot, connecting a sending domain walks you through it. LevelUp handles this as part of HubSpot implementation. More context in keeping your email IP healthy.

Related: What HubSpot services does LevelUp Digital offer?. Can LevelUp Digital build custom HubSpot integrations?.