If you've ever set up email infrastructure, you've encountered SPF, DKIM, and DMARC. These three records work together to prove your emails are legitimate. Let's break them down without the jargon.

SPF: Who's Allowed to Send?

SPF (Sender Policy Framework) is like a guest list. It tells receiving mail servers which IP addresses and services are authorized to send email on behalf of your domain.

When Gmail receives an email from your domain, it checks your SPF record: "Is this sender on the approved list?" If not, the email is more likely to be flagged.

DKIM: Is the Email Tampered?

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Think of it as a wax seal on a letter. The receiving server can verify that the email hasn't been modified in transit and that it genuinely came from your domain.

DMARC: What Happens When Checks Fail?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together with a policy. It tells receiving servers what to do when an email fails authentication: accept it anyway, quarantine it, or reject it outright.

It also gives you reporting, so you can see who's sending email on behalf of your domain (including unauthorized senders).

All Three Together

Think of it this way:

SPF: "Only these senders are allowed"
DKIM: "This email hasn't been tampered with"
DMARC: "Here's what to do if either check fails"

Setting Them Up

With StackMail, all three records are configured automatically when you connect your domain. No manual DNS editing required.

The StackMail Blog

SPF, DKIM, and DMARC Explained Simply