SPF, DKIM and DMARC, explained with real records

SPF, DKIM and DMARC used to be optional hygiene. Since February 2024, Google and Yahoo require all three from anyone sending more than 5,000 messages a day to their users, and expect at least SPF or DKIM from everyone else. Since May 2025 Microsoft applies similar rules to high-volume senders to Outlook.com, Hotmail and Live addresses. In practice, a business without them is more likely to land in spam - and is easier to impersonate.

An email carries two “from” addresses: the envelope sender used by mail servers, and the From header a person reads. SPF checks the first. An attacker can pass SPF for their own domain while showing your domain in the From line.

DMARC closes that gap by requiring alignment: the domain in the visible From must match the domain that passed SPF or the domain that signed with DKIM. Without alignment, a message can pass SPF and still be a forgery of your name.

All three are TXT records in your domain's DNS. Publish only one SPF record per domain.

SPF for Google Workspace

example.com   TXT   "v=spf1 include:_spf.google.com ~all"

SPF for Microsoft 365

example.com   TXT   "v=spf1 include:spf.protection.outlook.com -all"

Add an include: for every other service that sends as your domain - newsletter tool, invoicing software, help desk. SPF allows at most 10 DNS lookups in total, including nested includes.

DKIM

Your mail provider generates the key. In Google Workspace it is in the Admin console under Apps → Google Workspace → Gmail → Authenticate email. In Microsoft 365 it is in the Defender portal under Email authentication settings. You publish the record it gives you, then turn signing on. Every third-party sender needs its own DKIM setup too.

DMARC

_dmarc.example.com   TXT   "v=DMARC1; p=none; rua=mailto:[email protected]"

p is the policy, rua is where aggregate reports go. Add sp= to set a policy for subdomains and pct= to apply a stricter policy to only part of your mail while testing.

From any terminal:

nslookup -type=txt example.com
nslookup -type=txt _dmarc.example.com

Or open any email you sent to a Gmail account and choose “Show original”: the top of the page shows SPF, DKIM and DMARC as PASS or FAIL for that exact message.

1. 1Publish p=none with a rua address. Nothing is blocked; receivers send daily reports of who is sending as your domain.
2. 2Read the reports for two to four weeks. Every legitimate service in them gets added to SPF or set up with DKIM.
3. 3Move to p=quarantine, optionally with pct=25 first. Failing mail goes to spam instead of the inbox.
4. 4When nothing legitimate fails, move to p=reject. Exact spoofing of your domain is now refused by receivers that honour DMARC.

Aggregate reports are XML files. A free DMARC report reader turns them into a readable list of senders.

Aggregate reports arrive as XML from each large receiver, usually once a day. Turned into a table, a week of reports for a small company often looks like this:

The goal before moving to quarantine is simple: every row you recognise passes, and every row that fails is something you do not want sending as you.

Most small companies send as their domain from more places than they realise: a newsletter platform, a CRM, an invoicing tool, a help desk, a website contact form, a calendar booking tool. Each one needs to be covered, and there are two ways:

• DKIM for your domain. The tool gives you DNS records (often CNAMEs) to publish; it then signs as your domain. This is the more reliable option for DMARC, because DKIM survives forwarding and SPF does not.
• An SPF include. Adds the tool's servers to your list. Simple, but each include costs lookups against the limit of 10.
• A subdomain. Sending marketing from news.example.com keeps its reputation and records separate from your everyday mail.

• Two SPF records on the same domain. Receivers treat this as an error, so SPF fails for everything.
• More than 10 DNS lookups. Each include of a large provider can use several; the record silently fails past the limit.
• Forgetting a sender. The invoicing system or website contact form starts landing in spam after p=quarantine.
• Jumping straight to p=reject before reading reports, and blocking your own legitimate mail.
• Protecting the main domain but leaving unused domains open. Publish "v=spf1 -all" and a p=reject DMARC on domains that never send mail.

• They stop exact impersonation of your domain. They do nothing about lookalikes like example-billing.com.
• They do not filter phishing sent to you. That is the job of inbound filtering.
• A message from a hijacked real account passes all three, because it really is from that domain.