NVHCloud
Français
Español
Germany
United States
Canada
SPF, DKIM and DMARC are three DNS records that prove to mail providers that emails sent in your domain's name really come from you. Without them, your messages, including invoices, order confirmations and password resets, end up in spam or are rejected outright.
1. Why it has become mandatory
Since February 2024, Gmail and Yahoo require every sender to authenticate their email with SPF or DKIM, and bulk senders, above 5,000 messages a day to Gmail, to publish all three, DMARC included. Microsoft followed in 2025 for Outlook and Hotmail. In practice, a domain without these records sees its deliverability collapse, even for a few messages a day.
| Mechanism | What it proves | Where |
|---|---|---|
| SPF | Which servers are allowed to send for your domain | A TXT record on the domain |
| DKIM | That the message was signed by the sender and has not been altered | A public key in TXT on a subdomain |
| DMARC | What to do when SPF and DKIM fail, and where to send reports | A TXT on _dmarc |
2. List everything that sends
Before writing anything, list every service that sends email with your domain: your mailbox provider (Google Workspace, Microsoft 365, your host), your website, your newsletter tool, your invoicing software, your servers through an SMTP relay. Each one must appear in SPF and, ideally, sign with DKIM. A forgotten service will see its messages rejected once DMARC is tightened.
3. SPF
SPF is a TXT record placed at the root of the domain. Example for a domain that sends with Google Workspace and an SMTP relay:
yourdomain.com. TXT "v=spf1 include:_spf.google.com include:spf.provider.com ~all"include:authorises a provider's servers; each provider gives the value to use in its documentation.ip4:203.0.113.10authorises a specific address, for example a VPS that sends directly.~allends the record: other servers are suspicious. With DMARC in place, this is the recommended value;-allrejects them outright.
include counts, including those nested inside it. Beyond that, SPF fails for all your messages.A domain that never sends email should say so, to prevent spoofing: "v=spf1 -all".
4. DKIM
With DKIM, the sending server signs each message with a private key; the matching public key is published in DNS under a "selector". You almost never have to generate the key yourself: each provider generates it and gives you the record to create, for example:
google._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."Each service that sends for you has its own selector, and therefore its own record: they coexist without any problem. Then enable signing in the service's interface, often a button such as "Authenticate domain" or "Start authentication".
Some providers ask for a CNAME record rather than a TXT: they then manage the key and its rotation themselves. Just follow their instructions.
5. DMARC, in three steps
DMARC builds on SPF and DKIM and adds a requirement: the validated domain must match the domain visible in the message's "From" field. It also says what to do with messages that fail. Roll it out gradually:
- Observe, for two to four weeks:
Nothing is blocked, but providers send you daily reports showing which servers send in your name and whether they pass SPF and DKIM. This is where you discover the forgotten service._dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]" - Quarantine unauthenticated messages once all your legitimate services pass:
p=quarantine. - Reject:
p=reject. Nobody can send email pretending to be your domain any more.
The reports are hard-to-read XML files: a DMARC analysis tool, many of which have a free tier, turns them into a table.
6. Reverse DNS, if your VPS sends directly
If a server sends by itself, without a relay, its IP address must have a reverse DNS (PTR record) pointing to a name that itself points back to that address. Without it, many receiving servers reject the message. Reverse DNS is configured by the owner of the IP address, i.e. your hosting provider: contact support if the option does not appear in your client area. That is one more reason to use a relay, as explained in configuring Postfix.
7. Test
First check what DNS actually publishes:
dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com
dig +short TXT google._domainkey.yourdomain.comThen send an email to a Gmail inbox and open Show original: the SPF, DKIM and DMARC lines must all say PASS. Online services such as mail-tester also give a score out of 10 with details of any problems. For the basics of DNS records, see configuring DNS.
Frequently asked questions
Are SPF, DKIM and DMARC mandatory?
For bulk senders to Gmail and Yahoo, all three have been since 2024. For everyone else, at least SPF or DKIM is required, and the absence of DMARC hurts deliverability. In practice, set up all three, even for a small domain.
Can I have several SPF records?
No. A domain must have only one TXT record starting with v=spf1. If there are several, the check fails. Merge all the includes into a single record.
My emails go to spam even though SPF is valid. Why?
SPF alone is no longer enough. Check that DKIM really signs your messages and that a DMARC record exists. Also check alignment: the domain of the visible sender address must match the domain validated by SPF or DKIM.
How long should I stay at p=none?
Long enough to receive and analyse the reports, usually two to four weeks, and until all your legitimate services pass SPF or DKIM with alignment. Then move to quarantine, then to reject.