DKIM, SPF and DMARC explained (in plain English)
If your emails land in spam, it is almost always authentication. DKIM, SPF and DMARC are three DNS records that prove to Gmail and Outlook that you really are the sender. Here they are, without the jargon.
SPF — who may send for your domain
SPF (Sender Policy Framework) is a list, published in your DNS, of which servers are allowed to send mail with your domain in the From. The receiver checks whether the sending server is on that list.
; TXT record at the domain root
yourdomain.com. TXT "v=spf1 include:_spf.your-provider.com -all"The trailing -all means "reject everything else". Important: SPF breaks on forwarding, which is why it is not enough on its own.
DKIM — the cryptographic signature
DKIM (DomainKeys Identified Mail) adds a digital signature to every email. Your provider signs the message with a private key and publishes the public key in your DNS. The receiver verifies the content was not altered and that it comes from your domain.
; CNAME record (your provider gives you this)
abc123._domainkey.yourdomain.com. CNAME abc123.dkim.your-provider.com.Unlike SPF, DKIM survives forwarding because it travels inside the message itself. It is the most important piece.
DMARC — the policy
DMARC (Domain-based Message Authentication) ties the other two together. It tells the receiver: "if a message claiming to be from me fails both DKIM and SPF, do this". It also sends you reports of who is sending in your name.
; TXT record at _dmarc.yourdomain.com
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"The possible policies:
p=none— monitor only (start here).p=quarantine— send failures to spam.p=reject— reject failures outright (the final goal).
The key concept: alignment
It is not enough for DKIM or SPF to pass; the signing domain must match the From domain. This is called alignment, and it is what makes DMARC accept the email. That is why sending from @gmail.com through another service never aligns.
How to check it works
Send yourself an email to Gmail, open it, click the three dots → "Show original". You will see three lines: SPF, DKIM and DMARC, each with PASS or FAIL. All three should say PASS.
With Zend24 you don't have to fight with this: when you verify your domain we give you the exact records (or create them for you by connecting your DNS) and sign every email with DKIM automatically. Try it free.
Preguntas frecuentes
Do I need all three: DKIM, SPF and DMARC?
Yes. Gmail and Yahoo require authentication for senders since 2024. DKIM and SPF prove the email is legitimate; DMARC tells the receiver what to do if they fail. Together they are the minimum standard to deliver.
What DMARC policy should I start with?
Start with p=none, which only monitors without blocking anything. Review the reports for a few weeks and, once all your legitimate mail passes, move to p=quarantine and finally p=reject.