SPF, DKIM and DMARC, Explained Simply

What each record does, the mistakes that break them, and how Gmail and Yahoo use them.

Check your domain first: it's free

Our checker reads your public SPF, DKIM, DMARC and MX records and explains each in plain English. Nothing is stored.

Run the free email check

The 30-second version

SPF lists which servers may send email for your domain.
DKIM signs each email so the receiver can check it came from your domain and wasn't changed.
DMARC tells receivers what to do when SPF and DKIM don't pass for your domain, and where to send reports.

SPF

SPF is a single TXT record on your domain, defined in RFC 7208. Rules worth knowing:

Only one SPF record per domain. Two records make SPF fail.
At most 10 terms that need DNS lookups (the include, a, mx, ptr and exists mechanisms and the redirect modifier). Each provider's include: can use several.
Avoid +all, which lets any server send as you.

Illustrative example (use your providers' exact values):

v=spf1 include:_spf.google.com include:your-other-sender.example ~all

DKIM

DKIM (RFC 6376) uses a public key published at selector._domainkey.yourdomain. Each sending tool gives you its own selector and key or CNAME record. Google requires keys of at least 1024 bits for personal Gmail and recommends 2048. Setup guides: Google Workspace, Microsoft 365.

DMARC

DMARC (RFC 7489) is a TXT record at _dmarc.yourdomain. Its p= policy is none (no specific action), quarantine (treat failing mail as suspicious) or reject. A safe roll-out: start at p=none with a rua= address to receive reports, fix every legitimate sender that shows up failing, then tighten.

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.example

Alignment: why "SPF pass" can still be a "DMARC fail"

DMARC only counts SPF or DKIM if the domain they authenticate matches the domain in your From: address. Google: "The authenticating domain must be the same domain that appears in the message From: header." A CRM or invoicing tool that sends with its own return-path domain can pass SPF for its domain while failing DMARC for yours. The usual fix is to turn on DKIM signing with your domain in that tool.

What Gmail and Yahoo require

All senders (Gmail and Yahoo): SPF or DKIM, valid forward and reverse DNS, spam rate below 0.3%, and messages formatted to RFC 5322. Gmail also requires a TLS connection.
Bulk senders (Gmail: more than 5,000 messages a day to Gmail accounts): SPF and DKIM, DMARC with at least p=none, From: aligned with SPF or DKIM, and one-click unsubscribe plus a visible unsubscribe link for marketing and subscribed messages. Yahoo also asks that unsubscribes are honoured within 2 days.

Summarised from Google's Email sender guidelines and Yahoo's Sender Hub, read 24 Oct 2026.

Prefer someone to fix it for you?

We set up or correct SPF, DKIM and DMARC through a fixed-scope Fiverr gig. You add the records yourself with our guide or grant delegated, revocable access to your DNS host. We never ask for passwords, and we can't guarantee inbox placement: that also depends on content, reputation and the receiver.

See the email-fix gig on Fiverr

Frequently asked questions

Can I have two SPF records?

No. RFC 7208 says a domain must not have multiple SPF records; merge everything into one record.

What DMARC policy should I start with?

Start with p=none and a rua address for reports. It does not block mail. Move to quarantine or reject only after every legitimate sender passes.

Do I need DKIM for every tool that sends as me?

Ideally yes. Each tool that sends with your From: address should sign with DKIM for your domain, or be covered by SPF with aligned domains, so its mail can pass DMARC.

Does DMARC stop people spoofing my domain?

A quarantine or reject policy asks receivers to treat failing mail as suspicious or reject it, which makes direct spoofing of your exact domain much harder. Receivers decide how to apply it, and p=none only monitors.

Will setting these up fix my spam problem?

It fixes authentication, which is required by Gmail and Yahoo for many senders and is a common cause of filtering. Content, reputation and recipient feedback also matter, so no one can guarantee inbox placement.

Sources

Official documents we read on 24 Oct 2026. Requirements change, so check the source before acting.