People still ask which authentication record they should "just set up." The short answer: all three. They do different jobs, and Gmail, Yahoo, and Outlook now treat missing pieces as a deliverability problem, not a nice-to-have.
Here's what each one actually does — and what breaks if you skip it.
SPF: Who Is Allowed to Send?
SPF (Sender Policy Framework) is a DNS TXT record on your domain that lists the servers allowed to send mail for it. Receivers look at the envelope sender (Return-Path / MAIL FROM) and check that the connecting IP is in your list.
A simple record looks like:
v=spf1 include:_spf.google.com include:mailgun.org -allinclude:pulls in a provider's approved IPs-allmeans "fail anything not listed" (prefer this over~allonce you're sure)
What SPF does not do: it doesn't protect the visible From: address on its own, and it breaks when mail is forwarded (the forwarder's IP isn't in your record). That's why SPF alone is not enough.
DKIM: Was This Message Tampered With?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to the message. The public key lives in DNS; the sending server signs headers and body with the private key. If anything important is altered in transit, the signature fails.
You typically get DKIM from your ESP or Google Workspace / Microsoft 365 as a selector._domainkey TXT record.
What DKIM does not do: a valid signature can be for a domain that isn't the one in From:. Without DMARC alignment, a spammer can DKIM-sign as evil.example while displaying your brand.
DMARC: What Should Happen When They Fail?
DMARC sits on top. It requires that SPF or DKIM pass and that the passing domain aligns with the From: domain. Then it tells receivers whether to monitor, quarantine, or reject failures — and where to send reports.
That's the piece that stops spoofing and gives you visibility into who is sending as you.
Do You Need All Three?
| Setup | What you get | What you don't |
|---|---|---|
| SPF only | Basic IP allow-list | No integrity check, weak spoofing protection, forwarding pain |
| DKIM only | Tamper evidence | No sending-source policy, no alignment |
| SPF + DKIM | Solid technical auth | Receivers don't know your policy; spoofing still easy |
| SPF + DKIM + DMARC | Alignment, policy, reports | Nothing essential — this is the baseline |
Google and Yahoo's bulk-sender requirements made this explicit: if you send any real volume, SPF, DKIM, and a DMARC record (at least p=none to start) are expected.
Publish SPF and DKIM for every platform that sends as you (mailbox provider, ESP, billing tool, CRM). Then add DMARC at p=none, read two weeks of reports, and only then tighten the policy.
Common Mix-ups
- Too many SPF lookups. SPF allows 10 DNS lookups. Nested
include:chains fail the whole record. Flatten or drop unused vendors. - DKIM selector mismatch. The
s=in the signature must match the DNS name you published. - SPF pass, DMARC fail. Your ESP sent from a domain that doesn't match
From:. You need DKIM aligned to the visible domain, or a custom return-path.
The Practical Answer
You need SPF to authorize senders, DKIM to prove the message is intact, and DMARC to bind both to your brand and tell receivers what to do. Skipping one is how mail that "looked authenticated" still lands in spam — or how someone else sends as you.
If you want this configured without the trial-and-error, we set it up as a one-off service.