SPF, DKIM, and DMARC explained in plain English
Why your emails land in spam, what these three DNS records do, and how to check whether your domain is set up correctly.
The Sitize Team2 min read
You write a great email, hit send, and it lands in spam. Often the problem isn't the content. It's that inbox providers can't confirm the email really came from you.
That's what SPF, DKIM, and DMARC are for. They're three records added to your domain's DNS settings, and together they prove your emails are legitimate.
SPF: who is allowed to send
Sender Policy Framework is a list of the services allowed to send email for your domain, such as Google Workspace, Microsoft 365, or your email marketing platform.
When an email arrives, the receiving server checks: did this come from a server on the list? If not, it gets suspicious.
Common mistake: adding a new sending tool and forgetting to add it to SPF.
DKIM: a tamper-proof signature
DomainKeys Identified Mail adds a digital signature to every email you send. The receiving server checks the signature against a public key in your DNS.
If the signature matches, the server knows the email came from your domain and wasn't changed along the way.
Common mistake: setting up DKIM for your main inbox but not for your marketing platform.
DMARC: what to do when checks fail
Domain-based Message Authentication, Reporting and Conformance tells inbox providers what to do with emails that fail SPF or DKIM:
p=none: deliver them anyway, but send me reportsp=quarantine: send them to spamp=reject: block them
DMARC also sends you reports, so you can see who is sending email using your domain, including people who shouldn't be.
Common mistake: jumping straight to p=reject before checking the reports, which can block your own legitimate email.
Why this matters more now
Major inbox providers, including Gmail and Yahoo, now require bulk senders to authenticate their email with SPF, DKIM, and DMARC. Without them, more of your email will land in spam, or not arrive at all.
How to check your setup
- Send an email to a Gmail account, open it, and choose Show original. Look for
PASSnext to SPF, DKIM, and DMARC. - Use a free DNS lookup tool to view your domain's SPF and DMARC records.
- Check that every service that sends email for you is covered.
If any of these fail, it's worth fixing before your next campaign.
Want us to check it for you? Talk to our team and we'll review your email setup.