SPF, DKIM and DMARC explained

What is the difference between SPF, DKIM and DMARC?

SPF identifies authorized sending servers, DKIM adds a verifiable signature, and DMARC checks whether an authenticated domain aligns with the address readers see. They solve related problems, so setting up one does not replace the others.

Think of this table as a troubleshooting map: start with the failing check instead of replacing every record at once.

SPF: list your sending services

An SPF record tells receiving servers which sources are authorized for its domain. It is published in DNS, usually as a TXT record. Before editing it, identify every legitimate sender: your staff mailbox provider, application, campaign service, support tool, and website forms may use different systems.

Use each provider’s current instructions to determine which domain and values need configuration. SPF checks the envelope sender identity, which can differ from the From address shown in an inbox. A valid SPF record alone therefore does not establish that the visible address is authenticated.

Keep a short inventory with the service name, domain, DNS owner, and person responsible. When a service is retired, review its authorization instead of leaving the entry indefinitely. Google’s SPF setup guide explains sender inventories and DNS configuration.

DKIM: add your provider’s DNS record

DKIM lets a receiving server verify a message signature using a public key published for the signing domain. The signature covers specified headers and message content; it is not encryption of the email.

Generate or obtain the DKIM configuration from the service that will sign the messages. Publish the exact record type, hostname, and value it supplies. Providers can use different selectors and may ask for TXT or CNAME records, so a record copied from another account is not a substitute.

Send a real test through each service after setup. A DNS record existing is only one part of the check: the outgoing message must actually be signed and pass verification. See Google’s explanation of DKIM for how the public key and signature work.

DMARC: check alignment and set a policy

DMARC connects authentication to the domain in the visible From address. It can pass when SPF passes with an aligned domain, or when a valid DKIM signature uses an aligned domain. A passing authentication result for an unrelated domain is not enough.

The policy can request monitoring, quarantine, or rejection for messages that fail DMARC. Reporting can help you identify legitimate systems that still need attention. Do not move an established domain to a stricter policy until you understand its sending sources and their results.

For an organization with several senders, make a worksheet with one row per source and columns for SPF, DKIM, alignment, and the latest test. Fix the individual failing source, then review the policy. Google’s DMARC setup guidance covers policies and reporting.

Email authentication checklist

1. Choose the stream. Record whether you are testing a campaign, password reset, receipt, or another message.
2. Record the identities. Note the visible From domain, envelope sender domain, and DKIM signing domain.
3. Check DNS. Compare the published records with the sending service’s instructions.
4. Send a real message. Use a mailbox you control and inspect the full headers or authentication details.
5. Save the result. Record pass/fail results, alignment, sending service, and test time.
6. Repeat per source. One successful campaign does not test the separate service that sends your application’s receipts.

If a check fails, retain the result before changing configuration. It gives your DNS owner and sending provider a concrete example to investigate.

Authentication and email delivery

Gmail requires SPF or DKIM for all senders to personal Gmail accounts. Its bulk-sender requirements include SPF, DKIM, DMARC, alignment, and one-click unsubscribe for marketing and subscribed messages. Check the current Gmail sender guidelines for the full scope and requirements.

Authentication does not guarantee inbox placement. Keep recipient expectations, complaint handling, unsubscribe behavior, and the usefulness of your messages in the same review.

For your next SendMailOS integration, start at the developer overview. For audience sending, connect these checks with your campaign preparation and keep a test record for each sending domain.

Further reading

• Google Workspace: Set up SPF
• Google Workspace: Set up DKIM
• Google Workspace: Set up DMARC
• Gmail: Email sender guidelines

Sources reviewed on October 23, 2026.