SPF vs DKIM vs DMARC, explained like you're busy
Three DNS records decide whether receivers trust your email. Here's what each one does.
SPF — the guest list
What it does: lists which servers are allowed to send email for your domain. When mail arrives claiming to be from you, the receiver checks whether the sending server is on your list.
What it looks like: a TXT record on your domain, e.g. v=spf1 include:_spf.google.com ~all. The ~all ending means "treat anything not on this list with suspicion."
The two ways it silently breaks: publishing more than one SPF record (receivers treat that as a permanent error), and exceeding the 10-DNS-lookup limit — every include: costs lookups, and stacking tools (Google + Mailchimp + CRM + helpdesk) blows past ten without warning. Your mail then fails SPF even though the record "looks fine."
DKIM — the wax seal
What it does: your server cryptographically signs each message; the public key lives in your DNS. If the message is altered in transit or the signature doesn't verify, receivers know something's wrong.
What it looks like: a TXT record at selector._domainkey.yourdomain.com. The "selector" is a name your provider chooses — Google uses google, Microsoft uses selector1/selector2. You'll find yours in your email provider's admin panel.
How it breaks: the key was never published, was removed during a DNS migration, or the provider rotated selectors. Because nothing visibly fails, senders often go months without noticing.
DMARC — the instructions
What it does: tells receivers what to do when SPF and DKIM fail: nothing (p=none), send it to spam (p=quarantine), or reject it (p=reject). It also makes providers send you reports about who is sending as your domain — which is how you discover spoofing.
What it looks like: a TXT record at _dmarc.yourdomain.com, e.g. v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com.
The common mistake: publishing p=none and stopping. That's monitoring mode — anyone can still spoof your domain and the mail gets delivered. Run p=none for a few weeks to confirm legitimate mail passes, then move to quarantine, then reject.
What most senders should publish
SPF: one record listing only your actual senders, ending in ~all or -all. DKIM: enabled at your provider with the key verified in DNS. DMARC: p=quarantine or stricter, with rua= reporting. That combination satisfies the Gmail/Yahoo bulk-sender requirements and stops domain spoofing.
Check all three in ten seconds
The free InboxPreflight checker validates your SPF (including the lookup limit), finds your DKIM keys, grades your DMARC policy, and rolls it into a 0–100 score — no signup, nothing leaves your browser.