SPF, DKIM and DMARC, explained without the jargon

The problem these records exist to solve

Email was designed in an era when nobody expected people to lie. Nothing in the original design stops a stranger from putting your law firm’s domain in the "from" line of a message they send from their own machine. That is not a bug someone forgot to fix. It is how the protocol works, and it is why every serious spam problem of the last thirty years has been possible.

SPF, DKIM and DMARC are three separate patches on that hole. They are not security software and you do not install them. Each one is a short line of text you publish in your domain’s DNS settings — the same place your website’s address lives. Receiving mail servers look them up before deciding what to do with your message.

If you have ever wondered why one firm’s mail lands in the inbox and an almost identical firm’s lands in spam, this is usually the answer. It is rarely the writing.

SPF is a list of who is allowed to send as you

SPF stands for Sender Policy Framework, which tells you nothing. What it actually is: a published list of the servers permitted to send email using your domain name.

Your firm probably sends from more places than you think. Google Workspace or Microsoft 365 for day-to-day mail. An email platform for campaigns. Maybe your CRM sends automatic replies. Maybe your website’s contact form sends a confirmation. Each of those is a different server, and each one needs to appear in your SPF record.

A receiving server sees a message claiming to come from your domain, looks up your SPF record, and checks whether the machine that actually sent it is on the list. If it is not, that is a mark against the message.

DKIM is a signature that proves the message was not altered

DKIM signs each outgoing message with a cryptographic key. The matching public key sits in your DNS. A receiving server uses it to confirm two things: the message really came from somewhere authorized to sign for your domain, and nothing in it changed in transit.

The practical difference from SPF is that DKIM survives forwarding. If somebody forwards your newsletter to a colleague, SPF often breaks, because the forwarding server is not on your list. The DKIM signature travels with the message and still checks out.

You do not generate DKIM keys by hand. Your email platform produces the record and you paste it into DNS. It takes about ten minutes if you have access to the domain, and about three weeks if the domain is registered to a web designer who stopped answering emails in 2019. That second scenario is more common than the first.

DMARC tells receiving servers what to do when the first two fail

SPF and DKIM produce a result. DMARC decides what that result means. It is a policy record, and it says one of three things: do nothing, quarantine the message, or reject it outright.

DMARC also does something the other two cannot. It checks alignment — whether the domain in the "from" line the reader actually sees matches the domain that passed authentication. Without that check, a sender could pass SPF for a domain nobody sees while displaying yours in the header. Alignment is the part that makes the whole system worth anything.

Start at the do-nothing policy with reporting switched on. You will get reports showing everything sending as you, including the systems you forgot about. Fix what those reports surface, then tighten to quarantine, then reject. Publishing a reject policy before you know what sends on your behalf is how a firm accidentally blocks its own appointment reminders.

What Google, Yahoo and Microsoft now require

This all became urgent because the largest mailbox providers stopped treating it as advisory.

Google and Yahoo’s bulk-sender requirements apply to senders above roughly 5,000 messages a day to their users. Those senders must authenticate their mail with SPF and DKIM and publish a DMARC record, must offer one-click unsubscribe in the message headers, and must keep their spam-complaint rate below 0.30% — with 0.10% named as the level to actually aim for. Cross the threshold and delivery degrades.

Microsoft brought in its own version for high-volume senders to Outlook, Hotmail and Live addresses, effective 5 May 2025. The important difference is the consequence. Microsoft moved to rejecting non-compliant mail rather than filing it in the spam folder. A rejected message does not sit in a junk folder waiting to be found. It never arrives.

• Authenticate with SPF, DKIM and DMARC.
• Offer one-click unsubscribe in the headers, and honor it fast.
• Keep spam complaints under 0.30%, and treat 0.10% as the real target.
• Send only to people who asked, from a consistent domain.

You are nowhere near 5,000 a day, and you should do all of it anyway

A four-person firm emailing a list of 800 once a month is not a bulk sender by any definition these rules use. It is tempting to conclude none of this applies.

The conclusion is backwards. Volume thresholds decide when the published rules bite. They do not describe how filtering works the rest of the time. A large, established sender has years of history at a mailbox provider — a huge body of evidence that its mail is wanted. One bad campaign barely moves the average.

A small sender has no history to draw on. Every signal is a large fraction of the total evidence. Three people marking your newsletter as spam out of 800 is a complaint rate an enormous sender would never be able to produce. Authentication is the cheapest way for a small sender to be legible: it tells the receiving server who you are before it has any other reason to trust you.

A big sender is judged on its record. A small sender is judged on this message. Authentication is how you get judged fairly.

Blue Ocean Strategies

The other half of deliverability is behavior

Records get you the benefit of the doubt. They do not override what people do with your mail.

Two habits do more damage than any misconfigured record. The first is emailing addresses that have gone dead — an inbox that has not been opened in three years still accepts mail, and sending to enough of them signals that you are working from a list rather than a relationship. The second is burying the unsubscribe link. Somebody who cannot find it will press the spam button instead, and that is a far more expensive outcome than losing one subscriber.

Sending on a predictable schedule helps as well. A list that hears from you monthly recognizes you. A list that hears nothing for fourteen months and then receives a blast looks, to both the reader and the filter, like a list that was bought.

How to find out what you have right now

You can check most of this without touching anything. Open a message you sent recently from a mailbox outside your organization — a personal Gmail account is ideal — and view the original or full headers. Somewhere near the top you will see lines reporting SPF, DKIM and DMARC as pass, fail or none. Three passes and you are in reasonable shape. A "none" means the record does not exist at all.

Do that test for each system separately. Your day-to-day mail, your newsletter platform and your CRM are three different senders and they fail independently. We regularly find firms whose partner-to-client mail authenticates perfectly and whose marketing platform has never been configured, which is the worst combination, because the mail that most needs the benefit of the doubt is the mail not getting it.

The other thing worth knowing is who controls your DNS. It is often not your web host and often not you. Finding that out on a calm Tuesday is much easier than finding it out during the week your campaign is meant to go.

What we do about it

Deliverability set-up is part of onboarding on every email engagement, not an upsell. We audit what is currently sending as your domain, publish or correct the three records, watch the DMARC reports for a few weeks, and tighten the policy once we know nothing legitimate is being caught.

The account is opened in your name on your card, so the domain records and the sending reputation you build stay yours. If we stop working together, none of it leaves with us.