SPF, DKIM, and DMARC in plain English

Last reviewed September 18, 2026

Three acronyms show up in nearly every conversation about email security, and most explanations of them assume you already know how mail servers talk to each other. You don't need that. You need to know what question each one answers, what a "pass" means, and what none of them can tell you.

Think of a paper letter. SPF is the list of post offices allowed to stamp a company's envelopes. DKIM is a wax seal that proves the letter wasn't opened or altered on the way. DMARC is a note the company files with every post office in the country saying "if the stamp or the seal is wrong, here's what to do, and please tell me about it." Together they make it hard to forge the company's mail. They say nothing about whether the company itself is worth hearing from.

SPF: which servers may send for a domain

The domain's owner publishes a list of servers, in DNS, that are allowed to send mail using that domain in the envelope. When your mail server receives a message, it looks up that list and checks whether the sending server is on it. On the list is a pass. Not on the list is a fail. No list at all is "none."

DKIM: was the message signed and did the signature hold

The sending server adds a signature to the message using a private key. The matching public key sits in the domain's DNS. Your server fetches the public key and checks the signature. If the message was changed in transit, or the key doesn't match, the signature fails.

DMARC: what the domain owner wants done with failures

DMARC ties the other two together. It says whether the visible From address must line up with the SPF or DKIM domain, and it carries a policy: none (just report), quarantine (put it in spam), or reject (refuse it). It also asks receivers to send back reports so the owner can see who is sending as them.

What a pass does and does not mean

A pass on all three means the message really came from the domain in the From address and wasn't tampered with. That is all. It does not mean the domain is old, honest, or connected to the company the message talks about.

What "none" means, and why it matters

"None" for SPF or DMARC means the domain never published a record. Many small businesses are in that position without knowing it. It leaves their domain open to being spoofed, and it is the single most common thing we tell domain owners to fix.

How to check your own domain

Look up your domain's TXT records, or use any of the free DMARC checking tools. If you see no SPF record and no DMARC record, start with DMARC at p=none so you can collect reports before tightening anything.

Not sure how to publish these records? That's normal.

Most business owners never touch their registrar, DNS, or mail settings. Send the note below to whoever set up your website or email, or have one of our companies handle it.

Copy this to send to your IT person

Hi,

Could you check the email authentication records for our domain and fill in what's missing?

1. SPF: publish a TXT record at the root listing only the services that actually send our mail, ending in "-all". Remove the web server if it's listed and doesn't need to send.
2. DKIM: turn on DKIM signing at our mail provider and add the CNAME or TXT records it gives you.
3. DMARC: publish a TXT record at _dmarc.our domain with "v=DMARC1; p=none; rua=mailto:<an address that can receive reports>". Once reports show only our real senders passing, move p= to quarantine and then reject.

Background on why: https://www.unsolicitedoutreach.com/learn/spf-dkim-dmarc-plain-english

Thanks.

Email it

Or let us do it

37SOLUTIONS(opens in a new tab)DNS, SPF, DKIM, and DMARC set up correctly, and mailbox cleanup after a compromise.

These are our companies. Removal from this site is free and never depends on hiring us.

Where this shows up in the records here

Every record on this site lists the SPF, DKIM, and DMARC results captured when the message arrived, plus the DMARC policy the sending domain had published that day. When all three pass on a domain that is three weeks old, that is the whole story.