Guide
Three DNS records decide whether mail from your domain is believed. Here is what each one does, what mistakes break them, and how to tighten DMARC without blocking your own mail.
By Hamza Rivera, updated
Short answer: SPF lists the services allowed to send as your domain, DKIM signs each message, and DMARC says what to do when the checks fail and sends you reports. Set up the first two, publish DMARC with a policy that only reports, read the reports, and tighten it in steps.
SPF lists who may send for you, DKIM signs each message, and DMARC says what to do when the checks fail and sends you reports. Set up the first two, publish DMARC with a policy that only reports, read the reports, and tighten it in steps.
SPF is one TXT record on your domain. It lists the services allowed to send mail that uses your domain. The receiving server checks whether the sender is on the list. The ending matters. A dash before all (-all) means fail anything not listed, a tilde (~all) means treat it as a soft fail, a question mark (?all) means no opinion, and a plus (+all) means anyone may send, which defeats the point.
DKIM adds a signature to each message. The sending service signs with a private key and you publish the matching public key in DNS, at a name made of a selector, then _domainkey, then your domain. A receiving server uses the selector named in the signature to find the key and check the message was not changed. Gmail requires a key of 1024 bits or longer and recommends 2048.
DMARC is a TXT record at _dmarc on your domain. It asks receivers to compare the domain in the From line with the domain that passed SPF or DKIM, and says what you would like done with mail that does not match: nothing (none), treat it as suspicious (quarantine) or reject it. It also names an address for reports so you can see who sends as you.
These are made up records for yourbusiness.com. Yours will name your own services and keys. The DKIM key is cut short here on purpose.
yourbusiness.com. TXT "v=spf1 include:_spf.google.com include:mail.example-sender.net ~all"selector1._domainkey.yourbusiness.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."_dmarc.yourbusiness.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"The standard limits SPF evaluation to 10 DNS lookups. Include, a, mx, ptr, exists and redirect count. Plain IP addresses do not. Go over and the result is a permanent error, not a pass.
A domain must publish one SPF record. Two make the result a permanent error. Merge them into one.
The standard suggests stopping after two lookups that return nothing, so old includes that no longer exist cause trouble too.
Switching DKIM on in a sending service does nothing until the public key the service shows you is published in your DNS exactly as given.
A strict policy before every legitimate sender passes will block your own invoices, newsletters or form mail. This is the most expensive mistake on the list.
DMARC passes only if SPF or DKIM passes for a domain that matches the From domain. A third party signing with its own domain passes DKIM and still fails DMARC unless you set up its custom domain signing.
Nothing is blocked. You start receiving reports from the big providers showing who sends as you and whether they pass.
Reports are XML files, easier to read with a free or paid report viewer. Look for legitimate senders that fail.
Add them to SPF or turn on DKIM signing with your domain in each service.
The pct tag applies the policy to only a share of failing mail. The standard describes it as a way to roll out gradually. It defaults to 100 percent. Raise it in steps while you watch the reports.
Only once every legitimate sender passes. Keep reading reports afterward, because new tools get added.
Details here follow RFC 7208 for SPF, RFC 6376 for DKIM and RFC 7489 for DMARC, and the sender guidance Google publishes, all checked on 8 November 2026.
Gmail requires SPF or DKIM from everyone and all three, with DMARC at least p=none, from senders of more than 5,000 messages a day to personal Gmail. Yahoo asks for SPF, DKIM and a valid DMARC policy of at least p=none. Setting up all three is the sensible default even for a small sender.
A name that lets a domain publish more than one DKIM key. The selector appears in the signature and in the DNS name where the key lives, which is how key changes happen without breaking mail.
It means the domain owner asks for no action on failing mail. It still produces reports, which is why it is the safe first step.
Yes, if you can edit your domain’s DNS and you can find every service that sends as you. The step people get wrong is finding all the senders. If you would like someone to do it, send your domain through the form on this page.
No. These records let providers trust that mail really comes from you. They do not control how a provider treats the content or the complaints. Passieon is an independent agency and cannot promise placement.
Often minutes, sometimes longer, depending on the time to live set on the record and your DNS provider.
Message us
Ask anything about your site or where your enquiries are going. It goes straight to a person, not a bot. Leave an email and you get a reply.