SPF, DKIM & DMARC
Set up and troubleshoot email authentication so receivers trust your mail and impostors are rejected.
Start here
What is DMARC, and how does it work?
What DMARC is, how it uses SPF and DKIM alignment, what p=none, quarantine and reject do, what the reports show, and how to set it up in five safe steps.
9 min read SPF, DKIM & DMARCSPF vs DKIM vs DMARC: what each one proves, and what it doesn't
A plain-English comparison of SPF, DKIM and DMARC: what each checks, what it can't prove, how they work together, and where MTA-STS and BIMI fit.
8 min readSPF 5
Multiple SPF records found: why it causes PermError and how to merge them
Why a domain can have only one v=spf1 record, how two SPF records cause PermError and break DMARC, and how to merge them into one record safely, step by step.
8 min read SPF, DKIM & DMARCSPF record syntax and examples
SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.
9 min read SPF, DKIM & DMARCSPF softfail vs hardfail: should you use ~all or -all?
What ~all, -all and ?all mean in SPF, what receivers really do with each, how DMARC changes the choice, and which one to use for sending and parked domains.
8 min read SPF, DKIM & DMARCHow to fix SPF PermError: too many DNS lookups
Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.
8 min read SPF, DKIM & DMARCWhat is SPF, and how does an SPF record work?
What an SPF record is, how receivers check it against the envelope sender, the 10-lookup limit, what SPF can't do, and how to create one for your domain.
9 min readDKIM 7
How to find a domain's DKIM selector, and check its key
Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.
8 min read SPF, DKIM & DMARCDKIM "body hash did not verify" and other DKIM failures: causes and fixes
Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.
9 min read SPF, DKIM & DMARCDKIM 2048-bit key too long for a TXT record: how to split it correctly
Why a 2048-bit DKIM key won't fit in one 255-character TXT string, how to split it correctly, what Cloudflare, Route 53 and GoDaddy expect, and how to check it.
8 min read SPF, DKIM & DMARCWhat does each tag in a DKIM-Signature header mean?
Read a DKIM-Signature header tag by tag: v, a, b, bh, c, d, s, h, i, l, t and x per RFC 6376, what d= means for DMARC, why l= is risky, and how to check one.
9 min read SPF, DKIM & DMARCHow to rotate DKIM keys without breaking email
How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.
9 min read SPF, DKIM & DMARCHow to set up DKIM in Microsoft 365 and Google Workspace
Step-by-step DKIM setup for Microsoft 365 (two CNAME selectors) and Google Workspace (one TXT key): 2048-bit keys, key rotation and how to verify it works.
9 min read SPF, DKIM & DMARCWhat is DKIM, and how does a DKIM signature work?
What DKIM is, how a signature is created and verified, what d=, s=, h=, bh= and b= mean, how selectors, key length and Ed25519 work, and why DKIM fails.
10 min readDMARC 15
Why does DMARC fail? Causes and fixes for dmarc=fail
Troubleshoot dmarc=fail: alignment vs pass, third-party senders, forwarding, subdomains, DKIM d= and SPF MAIL FROM mismatches, with a causes-to-fixes table.
9 min read SPF, DKIM & DMARC"DMARC policy not enabled": what it means and how to fix it safely
Seeing "DMARC policy not enabled" or "no DMARC record found"? What the warning means, why it matters, and how to fix it without blocking your own email.
8 min read SPF, DKIM & DMARCHow do you check if an email passed SPF, DKIM and DMARC?
Check SPF, DKIM and DMARC results for any email in Gmail, Outlook and Apple Mail, then read the Authentication-Results header to see why it passed or failed.
9 min read SPF, DKIM & DMARCDMARC alignment: relaxed vs strict, and what adkim and aspf do
How DMARC alignment works, what adkim and aspf do, how the organizational domain is found, a pass/fail examples table, and when strict alignment is worth it.
9 min read SPF, DKIM & DMARCWhy do mailing lists break DMARC, and how do you fix it?
Why mailing lists break DMARC, how list software rewrites From or wraps posts, where ARC fits, and what RFC 9989 says about p=reject when your users post to lists.
9 min read SPF, DKIM & DMARCHow do you set up DMARC for your onmicrosoft.com domain?
Why your onmicrosoft.com (MOERA) domain needs its own DMARC record, how to add it in the Microsoft 365 admin center, how DKIM works for it, and how to check it.
8 min read SPF, DKIM & DMARCDMARC p=quarantine vs p=reject: which should you use?
What p=quarantine and p=reject do to failing mail at Gmail, Microsoft 365 and Yahoo, what RFC 9989 says, the risks of each, and when to move to reject.
9 min read SPF, DKIM & DMARCDMARC rua and ruf: how to set up DMARC reporting addresses
What DMARC rua and ruf do, the mailto syntax, how to send reports to another domain with a _report._dmarc record, failure report privacy and report volume.
9 min read SPF, DKIM & DMARCHow do you set up DMARC for Google Workspace?
Set up DMARC for Google Workspace: turn on DKIM first, publish SPF, add the _dmarc record at your DNS host, then move from p=none to quarantine and reject.
9 min read SPF, DKIM & DMARCDMARCbis and RFC 9989: what changed in DMARC, and what should you do?
RFC 9989 replaced RFC 7489 in May 2026. What DMARCbis changed (pct, t, np, psd, tree walk, rf and ri) and the few things a domain owner should do now.
9 min read SPF, DKIM & DMARCMoving DMARC from p=none to p=reject: a staged rollout for small businesses
A staged plan to move DMARC from monitoring to reject without blocking your own mail, including what changes when a filtering gateway sits in front.
9 min read SPF, DKIM & DMARCDMARC record examples, explained tag by tag
Copy-paste DMARC record examples for monitoring, quarantine and reject, with each tag explained and what RFC 9989 changed: pct removed, t, np and psd added.
9 min read SPF, DKIM & DMARCDMARC subdomain policy: how sp, np and the tree walk work
How DMARC covers subdomains: the organizational domain, the sp and np tags, the RFC 9989 DNS tree walk, and the subdomain mistakes that leave gaps.
8 min read SPF, DKIM & DMARCWhy email forwarding breaks SPF and DMARC, and how ARC helps
Why forwarding and mailing lists break SPF and sometimes DKIM, how that fails DMARC, and how SRS, ARC and trusted ARC sealers in Microsoft 365 help fix it.
9 min read SPF, DKIM & DMARCHow to read DMARC reports
A field-by-field guide to DMARC aggregate (rua) reports under RFC 9990: spot your real senders, tell forwarding from spoofing, and know when you can enforce.
9 min readMore authentication topics 8
How to stop others sending email as your domain
Stop criminals sending email as your domain: the DMARC path to p=reject, SPF and DKIM, subdomains and parked domains, monitoring, and what DMARC can't stop.
9 min read SPF, DKIM & DMARCWhat is ARC (Authenticated Received Chain), and how does it work?
How ARC works: the ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results headers, chain validation, how receivers use it, and where it falls short.
9 min read SPF, DKIM & DMARCHow does subdomain takeover through dangling DNS put your email at risk?
How dangling CNAME, MX and SPF include records let attackers claim your subdomains, receive your mail or pass DMARC, and how to audit and clean up DNS.
9 min read SPF, DKIM & DMARCBIMI explained: how to show your brand logo in the inbox
What BIMI is, what it needs (DMARC enforcement, an SVG Tiny PS logo, a VMC or CMC), which mailbox providers show the logo, what it costs and how to set it up.
8 min read SPF, DKIM & DMARCWhat do Gmail's warning banners mean, and how do you stop them on your mail?
What Gmail's "Be careful with this message", "This message seems dangerous" and "couldn't verify" warnings mean, and how senders can fix them.
9 min read SPF, DKIM & DMARCGmail, Yahoo and Microsoft bulk sender requirements explained
What Gmail, Yahoo and Outlook.com require from bulk senders: SPF, DKIM, DMARC, alignment, one-click unsubscribe and spam rates, with the real dates and limits.
9 min read SPF, DKIM & DMARCMTA-STS and TLS-RPT explained: how to set them up safely
What MTA-STS and TLS-RPT protect against, the DNS records and policy file you need, testing vs enforce mode, and safe rollout behind a filtering gateway.
9 min read SPF, DKIM & DMARCHow to protect parked and non-sending domains from spoofing
Lock down domains that never send email: Null MX, SPF -all, DMARC p=reject, the optional empty DKIM key, and subdomain wildcards, with a copy-paste checklist.
8 min readAbout these guides
SPF, DKIM and DMARC are the three DNS-based standards that let receiving servers check whether mail claiming to be from your domain really is. SPF lists the servers allowed to send for you. DKIM adds a cryptographic signature that shows a message wasn't changed after it was signed. DMARC ties both to the visible From address and tells receivers what to do when a message fails: nothing, quarantine or reject. Gmail, Yahoo and Microsoft now set authentication requirements for bulk senders.
These guides take you from a first record to full enforcement:
- SPF: syntax and examples, ~all versus -all, and fixing the 10 DNS lookup limit.
- DKIM: setup in Microsoft 365 and Google Workspace, and rotating keys without breaking delivery.
- DMARC: record examples, reading aggregate reports, subdomain policy, and a staged move from p=none to p=reject.
- Beyond the basics: forwarding and ARC, MTA-STS and TLS-RPT, BIMI, and locking down domains that never send mail.
Mistakes are common even at large organizations: our scan of the top 1,000 websites found that 38.3% don't enforce DMARC and 22 publish an SPF record over the 10-lookup limit. Check your records as you go with the free SPF Checker, DKIM Checker and DMARC Checker, or build new ones with the SPF Record Generator and DMARC Record Generator.
Frequently asked questions
Which should I set up first: SPF, DKIM or DMARC?
Start with SPF and DKIM for every service that sends as your domain, then publish DMARC at p=none with a reporting address. The reports show which senders pass. Once every legitimate source passes with alignment, move DMARC to quarantine and then to reject. Enforcing before SPF and DKIM are right blocks real mail.
Do email authentication records protect my own inbox?
Not directly. Your SPF, DKIM and DMARC records protect your domain's name in other people's inboxes, by letting them reject mail that impersonates you. What reaches your own inbox depends on your inbound filtering, which checks the sender's records, reputation and content. You need both.
How long does it take to reach DMARC p=reject?
For a small business with a few sending services, expect weeks to a few months. Most of the time goes into finding every service that sends as your domain and fixing its SPF or DKIM. Move one stage at a time, and give each stage two to four weeks of clean reports before tightening it.