[NOTICE] New account registration is currently closed. Existing members are unaffected.
itpromail
Log inSign up
home / blog / email authentication

SPF, DKIM and DMARC in plain language

Three DNS-based mechanisms decide whether your mail is trusted or tossed into spam. Here is what each one actually does.

September 29, 2026 · Email authentication · ITProMail team

If you host mail on your own domain, three DNS records determine whether receiving servers believe that messages from you are really from you.

SPF: who may send

Sender Policy Framework lists the servers allowed to send mail for your domain.

example.com. TXT "v=spf1 include:_spf.itpromail.com -all"

The -all at the end means anything not listed should be rejected.

DKIM: proof it was not altered

DomainKeys Identified Mail attaches a cryptographic signature to each outgoing message. The receiving server fetches your public key from DNS and checks that the signed headers and body are unchanged.

DMARC: what to do on failure

DMARC ties the two together. It tells receivers that a message must pass SPF or DKIM in alignment with the visible From domain, and what to do if it does not.

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Rolling it out safely

  1. Publish SPF and DKIM first.
  2. Start DMARC at p=none with a reporting address and read the reports for a couple of weeks.
  3. Move to quarantine, then reject once legitimate sources all pass.

Our custom domain guide lists the records to publish for hosted domains.

Related reading

< Metadata is the real leakFive tells of a modern phishing email >