SPF, DKIM and DMARC DNS Records
These 3 DNS TXT records help mail servers trust your domain email.
SPF says who can send. DKIM signs the email. DMARC says what to do if the email fails the check.
SPF
SPF tells other mail servers which server is allowed to send email for your domain.
- Email may go to spam.
- Fake sender may use your domain.
- Wrong SPF may cause sending problems.
- Use one SPF record only.
- Add only real sending services.
- Remove old mail services.
DKIM
DKIM adds a signature to the email. It helps prove the email was not changed.
- Receiver may not trust the email.
- Mail may be marked as suspicious.
- Wrong DKIM key will fail.
- Copy the full DKIM TXT value.
- Do not edit the key.
- Place it under the correct DNS name.
DMARC
DMARC tells mail servers what to do when SPF or DKIM fails.
- Fake email is harder to control.
- You may not see report information.
- Too strict setting may affect valid email.
- Make sure SPF works first.
- Make sure DKIM works first.
- Start with monitoring if unsure.
Easy Memory Note
This server can send email for my domain.
This email has a valid signature.
If the check fails, follow this rule.
Common Customer Mistakes
Record added in hosting panel, but active DNS is at Cloudflare or domain registrar.
SPF should normally be one TXT record. Multiple SPF records can fail validation.
DKIM is long. Missing even part of the key can cause failure.
Correct SPF, DKIM and DMARC can improve email trust and reduce spoofing risk.
They cannot promise every email will go to inbox. Email delivery also depends on content, sender reputation, recipient server rules and spam filtering.
Check DNS
Get Records
Add TXT
Wait DNS
Test Email
