What Are SPF, DKIM and DMARC? Plain English
SPF, DKIM and DMARC decide whether your business email lands in the inbox or in spam. Here is what each does, what Gmail requires, and how to check yours.
SPF, DKIM and DMARC are three DNS records that prove an email really came from your domain. When a message arrives, the receiving server asks three questions: is this server allowed to send for this domain, was the message tampered with, and what should I do if the answers are no. SPF, DKIM and DMARC answer those in that order. Get them wrong and your invoices land in spam. Get them right and criminals have a harder time pretending to be you.
This is the owner's view. If you are debugging mail sent from an app you built, our post on why emails from an AI-built app go to spam starts from message headers instead.
The three questions
Record | The question it answers | Where it lives |
|---|---|---|
SPF | Is this server allowed to send mail for the domain? | A DNS record listing approved senders |
DKIM | Was this message signed by the domain and left unaltered? | A public key in DNS, a signature in each message |
DMARC | What should receivers do when SPF and DKIM checks fail or do not match the From address? | A DNS record with your policy |
All three are stored in your domain's DNS, the system that maps names to settings. If DNS is hazy, read what DNS is first.
SPF: the guest list
SPF is a list of servers allowed to send email for your domain. When a message arrives, the receiver checks the sending server against that list. Every service that sends email as you, such as your email host, your invoicing tool, and your newsletter tool, needs to be on it.
DKIM: the wax seal
DKIM adds a cryptographic signature to each outgoing message. The matching public key sits in your DNS. The receiver uses it to check that the message was signed by your domain and that nothing changed in transit. Your email provider normally generates the key pair and tells you which DNS record to publish.
Google's sender guidelines state that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommend 2048 bits if your provider supports it.
DMARC: the instructions
DMARC ties the other two together. It checks that the domain in the visible From address aligns with the SPF or DKIM domain, and it tells receivers what to do with mail that fails. Google's page notes that for bulk senders "your DMARC enforcement policy can be set to none". That setting only monitors and reports. It is the usual first step, because moving straight to a strict policy can block your own legitimate mail if a sender was missed.
What Gmail actually requires
Google's email sender guidelines set different bars depending on volume.
Every sender: set up SPF or DKIM authentication for your sending domains, and use TLS to transmit email.
Bulk senders, meaning more than 5,000 messages a day to Gmail accounts: SPF, DKIM, and DMARC all required, with the From domain aligned to the SPF or DKIM domain.
Spam rate: keep the rate reported in Google Postmaster Tools below 0.3%. Google recommends keeping it below 0.10%.
Marketing and subscribed mail from bulk senders: support one-click unsubscribe and include a visible unsubscribe link in the body.
Most small businesses send far fewer than 5,000 messages a day, so the strict bulk rules do not apply to them. The sensible move is still to set up all three, since they protect your domain from being spoofed regardless of volume.
A practical setup order
List everything that sends email as your domain.
Publish one SPF record that covers all of them. A domain should have a single SPF record, so add new senders to it rather than creating a second.
Turn on DKIM in each sending service and publish the records they give you.
Publish a DMARC record with policy
noneand watch the reports for a few weeks.Tighten the policy only when the reports show every legitimate sender passing.
Step 2 is where small teams slip. Adding a second SPF record when you adopt a new tool is a classic mistake, and it can make checks fail.
Why this matters beyond spam folders
Criminals send fake invoices and password resets that look like they come from real companies. Authentication makes that harder to pull off against your domain, and it helps your customers too. For the reader's side of the same problem, see how to spot an AI-generated phishing email. If you build an app that sends mail, how to add email sending to an AI-built app covers the developer side. More small business guides are in the AI for small business hub.
Frequently asked questions
What is the difference between SPF and DKIM?
SPF checks that the sending server is on your approved list. DKIM checks a signature on the message itself, proving it came from your domain and was not altered.
Do I need DMARC if I only send a few emails?
Google requires DMARC only for bulk senders above 5,000 messages a day to Gmail. Smaller senders still benefit, because DMARC helps stop others from spoofing your domain.
What does a DMARC policy of none do?
It tells receivers to take no action on failing mail while you collect reports. Google notes that for bulk senders the policy can be set to none.
Can I have two SPF records?
A domain should have one. If you add a new sending service, update your existing SPF record instead of publishing another.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
