The Ultimate Guide to Email Authentication: SPF, DKIM & DMARC

Email deliverability has undergone a massive evolution. Major mailbox providers like Google, Yahoo, and Microsoft strict enforcement policies require every sender—whether sending 100 emails or 100,000 emails a day—to properly implement the holy trinity of email authentication: SPF, DKIM, and DMARC.

In this guide, goodboycoder breaks down how each protocol functions, why they depend on one another, and how you can configure them using our free developer tools in under 5 minutes.

1. SPF (Sender Policy Framework)

SPF allows domain owners to publish a list of IP addresses or subdomains that are authorized to send email on behalf of their domain.

How SPF Works:

1. You publish a TXT record at your domain's DNS root (e.g. yourdomain.com).
2. When an email server receives a message claiming to be from you@yourdomain.com, it performs a DNS lookup for the TXT SPF record.
3. If the sending server's IP address is listed in your SPF record, the check passes.

Example SPF Record:

v=spf1 ip4:192.0.2.1 include:_spf.google.com ~all

• v=spf1: Identifies the record as SPF version 1.
• include:_spf.google.com: Authorizes Google Workspace servers.
• ~all: Softfail directive instructing receivers to accept but flag non-matching senders.

2. DKIM (DomainKeys Identified Mail)

While SPF verifies sender IP addresses, DKIM verifies that the email content itself was not tampered with during transit using public-key cryptography.

How DKIM Works:

1. The sending mail server attaches a cryptographic signature header to outgoing emails.
2. The receiving server uses a public key retrieved from your DNS (at selector._domainkey.yourdomain.com) to verify the signature.
3. If the signature matches, the email is guaranteed to be authentic and untampered.

3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC builds on top of both SPF and DKIM. It tells receiving mail servers what to do when an email fails SPF or DKIM checks.

DMARC Policy Levels:

• p=none: Monitor mode. Emails pass through; reports are sent to you.
• p=quarantine: Sends suspicious emails straight to the recipient's Spam folder.
• p=reject: The highest security level. Immediately blocks and bounces unauthenticated emails.

Summary Checklist for 100% Deliverability

• [x] Create an SPF record including all ESPs using our SPF Generator.
• [x] Generate 2048-bit DKIM keys using our DKIM Generator.
• [x] Set a DMARC policy starting at p=none and test it with our DMARC Checker.
• [x] Test your email content with our Spam Score Checker.