SPF lists the servers allowed to send mail for your domain. DKIM adds a signature that proves a message was not changed and names the signing domain. DMARC checks that one of them passes for the domain in the From line, then tells receivers whether to deliver, quarantine or reject mail that fails.
| Record | DNS name | Starts with | Proves |
|---|---|---|---|
| SPF | Your domain (@), TXT | v=spf1 | The sending server is on your approved list |
| DKIM | selector._domainkey.yourdomain, TXT | v=DKIM1 | The message carries a valid signature from a domain |
| DMARC | _dmarc.yourdomain, TXT | v=DMARC1 | SPF or DKIM passed for the visible From domain, plus your policy |
Updated
If you send invoices, booking confirmations or newsletters from your own domain, these three DNS entries decide whether they land in the inbox or the spam folder. Each is a TXT record, a free-text DNS entry your DNS host lets you add. The builders below write the SPF and DMARC lines for you and check the syntax against the published standards. DKIM is different: your email provider generates its key, so you copy its value rather than writing one.
Tick the services that send as your domain and add any other servers. The result goes in one TXT record at @.
Services that send your mail
Publish the result as a TXT record named _dmarc. Begin with none, then tighten.
Tags are separated by semicolons. v must come first and p is required; everything else is optional.
| Tag | Meaning | Default |
|---|---|---|
| v | Version, always DMARC1, must be first | None, required |
| p | Policy: none, quarantine or reject | None, required |
| sp | Policy for subdomains | Same as p |
| pct | Percent of failing mail the policy applies to | 100 |
| rua | Where aggregate reports go | No reports |
| ruf | Where failure reports go | No reports |
| adkim / aspf | Alignment mode: r relaxed or s strict | r |
| ri | Requested seconds between aggregate reports | 86400 |
One include and one IP address cost a single DNS lookup between them, and anything else fails.
example.com. TXT "v=spf1 ip4:192.0.2.25 include:spf.protection.outlook.com -all"Selector s1 on example.com is looked up at s1._domainkey.example.com. The key itself comes from your provider.
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"Nothing is blocked yet; receivers send daily summaries of who mailed as your domain.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"The receiving server looks up SPF for the domain in the hidden envelope sender and compares the connecting server's address. It then verifies any DKIM signature by fetching the public key named in the signature's d= and s= tags.
Finally it reads your DMARC record at _dmarc and asks whether either passing check used a domain aligned with the From header. If neither did, it applies your p= policy.
As of October 2026, Gmail's sender guidelines ask bulk senders for SPF and DKIM, a DMARC record whose policy can be none, From domain alignment, one-click unsubscribe on marketing mail and a spam rate kept below 0.30% in Postmaster Tools.
Yahoo's sender hub lists matching rules: SPF and DKIM, a DMARC policy of at least p=none that must pass, a working one-click list-unsubscribe header and a spam rate below 0.3%.
As of October 2026, Gmail asks every sender for SPF or DKIM, and anyone sending 5,000 or more messages a day to Gmail accounts needs SPF, DKIM and DMARC. Yahoo asks bulk senders for SPF, DKIM and a DMARC policy of at least p=none. Setting up all three is the simple answer for any business domain.
The symbol before all is a qualifier. A minus means fail, a tilde means softfail, a question mark means neutral and a plus means pass. Most domains end with -all or ~all; +all would approve every server on the internet and should never be used.
The SPF standard says checkers must stop after 10 terms that need a DNS query: include, a, mx, ptr, exists and redirect. Includes inside includes count too. Going over gives a permanent error (permerror), so SPF no longer counts as a pass.
DMARC only counts a pass if the domain SPF or DKIM checked matches the domain shown in the From line. Relaxed alignment, the default, accepts a subdomain of the same organisation; strict alignment needs an exact match.
In your email provider's admin area, usually under authentication or domain settings. It gives you a selector name and a public key. You publish it at that selector under _domainkey, and the provider signs outgoing mail with the matching private key.
It can, if a service sending as your domain is missing from SPF and is not signing with DKIM. That is why the reports from p=none come first: they list every server sending as you, so you can fix them before tightening the policy.
Related: MX records explained, BIMI record guide, DNS record types, DNS lookup, Email marketing best practices.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.