Short answer: SPF, DKIM and DMARC are three DNS records that prove your emails really come from your domain. SPF lists the servers allowed to send your email, DKIM adds a digital signature to every message, and DMARC tells inboxes what to do with email that fails those checks and sends you reports. Without them, Gmail, Outlook and Yahoo are much more likely to send your email to spam, and scammers can impersonate you more easily.
If your quotations, invoices or newsletters keep landing in spam, these three records are the first thing to check. This guide explains each one in plain language, shows example records, and gives you a safe step-by-step rollout.
Why inboxes need proof
Email was designed in the early days of the internet without any built-in way to check who really sent a message. Anyone can type any address in the "From" line. Scammers exploit this constantly, pretending to be banks, payment providers and businesses.
SPF, DKIM and DMARC fix the problem by letting your domain publish, in DNS, which servers may send for it and how to verify its messages. Since 2024, Gmail and Yahoo have required them for bulk senders, and every major inbox provider uses them to decide what reaches the inbox.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a TXT record on your domain listing the servers allowed to send email for it.
v=spf1 include:_spf.yourprovider.com ~all
- v=spf1 starts the record.
- include: adds a provider's sending servers.
- ~all means "treat any other server as suspicious" (soft fail). -all means "reject others" (hard fail).
If you send from several services, for example business email plus an email sending service, combine them in one record:
v=spf1 include:_spf.provider-one.com include:_spf.provider-two.com ~all
SPF rules to remember
- Only one SPF record per domain. Two records break SPF entirely.
- At most 10 DNS lookups inside the record (each include: counts).
- SPF checks the hidden "envelope" sender, which is why it needs DMARC to protect the visible From address.
DKIM: a signature on every email
DKIM (DomainKeys Identified Mail) adds an invisible cryptographic signature to each email. Your provider signs with a private key and publishes the matching public key in your DNS, usually at an address like selector._domainkey.yourdomain.com as a TXT or CNAME record.
When an inbox receives your email, it fetches the public key and checks the signature. If it matches, the inbox knows the email really came from your domain and was not changed on the way.
DKIM tips
- Each sending service has its own DKIM record, so you can have several.
- Copy DKIM values exactly; a missing character breaks the signature.
DMARC: your policy and reports
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the address people actually see in the From line, and tells inboxes what to do when checks fail.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
It lives at _dmarc.yourdomain.com as a TXT record.
- p= is the policy: none, quarantine or reject.
- rua= is where daily summary reports are sent.
For DMARC to pass, at least one of SPF or DKIM must pass and be aligned with the From domain.
Rolling out DMARC safely
| Stage | Policy | What happens | How long |
|---|---|---|---|
| 1. Monitor | p=none | Nothing is blocked; you receive reports | 2 to 4 weeks |
| 2. Quarantine | p=quarantine | Failing email goes to spam | 2 to 4 weeks |
| 3. Reject | p=reject | Failing email is refused | Ongoing |
Read your reports during stage 1 to find every legitimate service that sends as your domain (your website's contact form, invoicing software, email marketing) and make sure each one passes SPF or DKIM. Then tighten the policy.
How SiloLobby sets this up
- Business email on a domain registered with SiloLobby: MX, SPF, DKIM and DMARC are added for you automatically.
- Email sending (SMTP and API): we show the exact DKIM CNAMEs, MAIL FROM records and TXT records to add, and add them for you if your domain is with SiloLobby.
- Domains registered elsewhere: copy the records from your client area into your DNS provider.
How to check everything works
- Send an email from your domain to a Gmail address.
- Open it and choose Show original (in the three-dot menu).
- Look for SPF: PASS, DKIM: PASS and DMARC: PASS.
Online DNS checking tools can also confirm that your SPF record is valid and that only one exists.
Common mistakes
| Mistake | Effect | Fix |
|---|---|---|
| Two SPF records | SPF fails for all mail | Merge into one record |
| Too many includes | SPF "too many lookups" error | Remove unused services |
| DKIM value copied with a typo | DKIM fails | Copy the value again exactly |
| Jumping straight to p=reject | Legitimate email bounces | Start with p=none and read reports |
| Forgetting a sending service | Its mail fails DMARC | Add its SPF include or DKIM record |
Other reasons emails land in spam
Authentication is essential, but inboxes also look at what you send and to whom:
- Sending to old, bought or scraped lists produces bounces and complaints.
- Spammy subjects (ALL CAPS, "FREE!!!", lots of exclamation marks).
- Link shorteners, or emails that are just one big image.
- Newsletters without an unsubscribe link.
- Sudden large volumes from a brand-new domain.
See how to do email marketing legally in Nigeria.
Understanding DMARC reports
DMARC aggregate reports arrive as compressed XML files, usually daily, from inbox providers such as Gmail and Microsoft. They list which servers sent email using your domain and whether each passed SPF and DKIM. Free online DMARC report readers turn them into simple tables.
Look for:
- Unknown sources sending as your domain: possible impersonation.
- Legitimate services failing: add their SPF include or DKIM record.
- Volume changes that might indicate a compromised account.
Setup checklist
- One SPF record listing every service that sends as your domain
- DKIM records published for your mailbox provider and each sending service
- DMARC record at _dmarc with p=none and a report address
- Test emails show SPF, DKIM and DMARC: PASS
- Reports reviewed for two to four weeks
- Policy raised to quarantine, then reject
Subdomains and DMARC
DMARC policies apply to subdomains too, unless you set a separate subdomain policy (the sp= tag). If you send marketing from news.yourdomain.com, make sure that subdomain also has the right SPF and DKIM records before tightening your policy.
Summary
SPF says who may send, DKIM proves each email is genuine, and DMARC enforces your policy and reports on fakes. Publish all three, keep one SPF record, roll out DMARC from p=none to p=reject, and check that every email passes. Your messages will reach the inbox more often, and scammers will find it much harder to impersonate you.