Email security: what are SPF, DKIM and DMARC?

Three DNS-based methods keep your emails out of spam folders and stop your domain from being used in forged emails: SPF, DKIM and DMARC. They work together.

SPF (Sender Policy Framework)

It publishes a list of the servers allowed to send email for your domain as a TXT record in DNS. The receiving server checks whether an incoming message came from an authorised server.

Example record: v=spf1 include:_spf.example-provider.com ~all

DKIM (DomainKeys Identified Mail)

It adds a digital signature to outgoing email. The public key is published as a TXT record in DNS; the receiver verifies the signature with it and knows the message was not altered on the way and really came from your domain. Your email or hosting provider usually generates the key.

DMARC

It is the policy that tells the receiver what to do based on the SPF and DKIM results: none (only report), quarantine (send suspicious messages to spam) or reject. You also receive summary reports.

Example record (_dmarc.example.com): v=DMARC1; p=none; rua=mailto:dmarc@example.com

Where to start

1. Add the SPF and DKIM records given by your email provider to your domain DNS settings.
2. Enable DMARC first with p=none and watch the reports for a few weeks.
3. Once all legitimate mail passes SPF or DKIM, move to quarantine and then to reject.

Common mistakes

• Creating more than one SPF record for a domain; there must be only one.
• Using so many includes in SPF that you exceed the limit of 10 DNS lookups.
• Setting DMARC straight to reject without reviewing reports.

DNS changes can take from minutes to a few hours to spread. If you get stuck, you can open a support request.