Guide · 3 min read
SPF, DKIM and DMARC, in plain language
Without these three DNS records, anyone can send email that looks like it came from your domain: fake invoices, fake order confirmations, fake password resets.
SPF: who may send for you
One TXT record on your domain listing your senders. Examples:
Google Workspace
v=spf1 include:_spf.google.com ~allMicrosoft 365
v=spf1 include:spf.protection.outlook.com ~all- Keep a single SPF record. Two SPF records make both invalid.
- Add each extra sender (newsletter tool, shop, CRM) with its own
include:. SPF allows at most 10 DNS lookups. - Never use
+all: it allows the whole internet.
DKIM: a signature on each email
Turn it on in your email provider’s admin console. It gives you a TXT or CNAME record to publish. Do the same for every service that sends mail as you.
DMARC: what to do with fakes
Add a TXT record at _dmarc.yourdomain.com. Start by monitoring:
_dmarc TXT
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comRead the reports for a few weeks, fix any legitimate sender that fails, then tighten to p=quarantine and finally p=reject. Gmail and Yahoo have required DMARC for bulk senders since February 2024.