spf, dkim and dmarc explained, without the jargon

Email was designed without any way to verify who a message is really from. Anyone can put your address in the From field. SPF, DKIM and DMARC are three DNS records bolted on afterwards to fix that — and if they are missing or wrong, your legitimate mail gets treated with suspicion.

They are not interchangeable and they are not alternatives. They do different jobs, and DMARC only works once the other two are in place.

SPF: who is allowed to send

SPF is a list of servers permitted to send email using your domain. A receiving server looks up that list and checks whether the message came from one of them.

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

The critical rule: you may have only ONE SPF record per domain. Two records do not combine — they invalidate each other and SPF fails entirely. If you add a service, extend the existing record rather than creating a second one.

DKIM: proof it was not tampered with

DKIM adds a cryptographic signature to every message you send. The matching public key lives in your DNS, so a receiving server can verify both that the message genuinely came from your domain and that nobody altered it in transit.

Where SPF asks 'was this server allowed to send?', DKIM asks 'is this message intact and genuinely signed?'. Crucially, DKIM survives forwarding — SPF often does not, which is why mail forwarded through a mailing list can fail SPF while remaining perfectly legitimate.

DMARC: what to do when checks fail

DMARC ties the other two together. It tells receiving servers what to do with mail that fails SPF and DKIM, and — the genuinely useful part — asks them to send you reports about it.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk

The policy value matters enormously:

• p=none — monitor only. Nothing is rejected; you just receive reports. Always start here.
• p=quarantine — failing mail goes to spam.
• p=reject — failing mail is refused outright.

The right order to do this in

1. 01List every system that sends email as your domain. Most organisations underestimate this — invoicing, CRM, marketing tools, the website contact form, the booking system.
2. 02Publish one SPF record covering all of them.
3. 03Enable DKIM signing at your mail provider and publish the key.
4. 04Publish DMARC with p=none and a reporting address.
5. 05Wait two to four weeks and actually read the reports.
6. 06Fix whatever is failing, then move to p=quarantine, then eventually p=reject.

The wait is the part people skip, and it is the part that stops you cutting off your own invoices. There is no advantage to rushing it — the protection only matters once the configuration is correct.