MaililoSPF vs DKIM vs DMARC: Complete Guide
The three email authentication standards explained in plain language, with example records and a checklist for getting all three to pass.
By Maililo Team · Published · Updated · 3 min read
SPF, DKIM and DMARC are three DNS-based standards that prove an email really came from your domain. Since 2024, Gmail and Yahoo require them for bulk senders, and missing them is one of the top reasons business mail lands in spam. Here's what each one does and how they fit together.
The short version
| What it checks | Where it lives | |
|---|---|---|
| SPF | Was the message sent from a server allowed to send for this domain? | TXT record on the root domain |
| DKIM | Was the message signed by the domain, and unchanged in transit? | TXT record at selector._domainkey |
| DMARC | Does SPF or DKIM pass and match the visible From domain? What should happen if not? | TXT record at _dmarc |
SPF (Sender Policy Framework)
SPF is a list of servers authorized to send mail for your domain. The receiving server looks at the connecting server's IP address and checks whether your SPF record allows it.
Example:
v=spf1 mx include:_spf.example-newsletter.com -all
mx— the servers in your MX record may sendinclude:— also allow another service's servers-all— reject everything else (~allmeans "soft fail")
Rules to remember:
- Only one SPF record per domain.
- SPF allows at most 10 DNS lookups; too many
include:entries make it fail. - SPF checks the hidden "envelope" sender, not the From address you see — which is why DMARC exists.
DKIM (DomainKeys Identified Mail)
With DKIM, your mail server adds a cryptographic signature to every message. The matching public key is published in DNS under a name called a selector, for example:
v1-rsa-20260926._domainkey.yourcompany.com
The receiver fetches the key and checks the signature. If the message was altered, or wasn't signed with your key, DKIM fails.
DKIM keys are unique to each domain, so never copy another domain's key. Many providers now publish two keys: an RSA key for broad compatibility and an Ed25519 key, which is newer and shorter.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC adds two things:
- Alignment: SPF or DKIM must pass for the same domain that appears in the From address. This stops spammers passing SPF with their own domain while showing yours.
- Policy: what receivers should do with failing mail.
Example:
v=DMARC1; p=reject; rua=mailto:postmaster@yourcompany.com
p=none— monitor onlyp=quarantine— send failures to spamp=reject— refuse failures outrightrua=— where to send daily aggregate reports
A common approach is to start with p=none, read the reports for a week or two to make sure all your legitimate senders pass, then move to quarantine or reject.
How they work together
When a message arrives, the receiver checks SPF and DKIM, then DMARC asks: did at least one of them pass and align with the From domain? If yes, DMARC passes. If no, the policy applies.
How to check your records
- In Gmail, open a message you sent and choose Show original. You'll see
SPF: PASS,DKIM: PASSandDMARC: PASSat the top. - Use a DNS lookup tool to confirm each TXT record exists and has exactly one copy.
- Maililo's domain page shows the status of each required record and the expected value next to what DNS currently returns.
Troubleshooting
- SPF fails: a sending service isn't listed, or you have two SPF records.
- DKIM fails: the key was copied incompletely, or the selector name is wrong.
- DMARC fails but SPF passes: alignment problem — a third-party tool sends with its own envelope domain. Enable DKIM signing for your domain in that tool.
Related: Why emails go to spam · How to improve email deliverability
Maililo generates DKIM keys for each domain and checks your SPF and DMARC records — learn more about connecting a custom email domain.
