SPF, DKIM and DMARC explained: how to keep your emails out of spam

SPF, DKIM and DMARC are email authentication methods that let receiving mail servers check that an email really comes from your domain. SPF lists the servers allowed to send your email, and DKIM adds a signature. DMARC tells the receiving server what to do with an email that fails these checks. Gmail, for example, is less likely to mark an email that passes as spam or to reject it.

You set them up as records on the domain you send from, the part after the @ in your address: yourbusiness.co.uk in hello@yourbusiness.co.uk. If you're new to email domains, start with what an email domain is.

What is an SPF record?

An SPF record is the TXT record in your domain's DNS that holds this list of servers. When your email arrives, the receiving server checks the sending server against it. If the server isn't on the list, the email may be rejected or treated as suspicious.

Your SPF record should name every service that sends email for you. A newsletter tool or a shop system that sends from your domain belongs in it too. A domain has one SPF record: a new sender goes into the existing record, never into a second one.

What is DKIM?

DKIM adds a digital signature to every email you send. The signature is invisible to you and your recipient, but the receiving server checks it against a public key in your domain's DNS. Only a server you've authorised to send for your domain can create the signature, while the public key lets any receiving server check it. When the signature checks out, the server knows the email really comes from your domain and wasn't changed on the way.

What is DMARC?

DMARC ties SPF and DKIM together. It checks whether SPF or DKIM confirmed the domain in the From address, the one your recipient sees. Your DMARC record then tells receiving servers what to do with an email that fails, and where to send reports about email sent in your domain's name.

Your DMARC policy is one of three:

• none: monitoring only. The receiving server is asked to take no particular action.
• quarantine: asks the receiving server to treat a failed email as suspicious, for example by putting it in the spam folder.
• reject: asks the receiving server to refuse a failed email.

The reports come in two kinds. Aggregate reports give an overview of the email sent from your domain and how it did in the SPF, DKIM and DMARC checks. Detailed reports cover single emails that failed. Not every email provider sends reports, so you may not get one for every email.

How SPF, DKIM and DMARC work together

When your email arrives, the receiving server runs the checks in order. SPF tells it whether the sending server is on your list. DKIM tells it whether the signature matches your domain. DMARC then looks at both results: the email passes when at least one of them passes for the same domain as the From address. If neither does, your DMARC policy decides what happens next.

DKIM on its own only proves that your domain signed the email. DMARC uses that proof, together with SPF, and tells the receiving server what to do when the proof is missing.

Which DMARC policy should you choose?

Our advice: start with none, and check the reports for a few weeks until they show that all your own senders pass. Then move to quarantine, and on to reject once quarantine runs without problems.

Reject gives the most protection against email that pretends to be yours, but going in steps protects your own email. With quarantine, a failed email from a sender you forgot is treated as suspicious, for example put in spam, rather than refused. Under reject, a strict policy too early can stop your own newsletters or invoices from arriving at all. That happens when a service that sends them isn't in your SPF record or doesn't sign with DKIM yet.

Reports, and a policy other than the standard one, need a custom DMARC record. Send the reports to a separate mailbox on your domain, such as dmarc-reports@yourbusiness.co.uk. They're meant for automated processing rather than reading by hand, so a DMARC report tool is the easiest way to read them. It turns them into an overview of which servers send email in your domain's name.

Do you need SPF, DKIM and DMARC for your own domain?

Yes, if you send email from your own domain. Gmail asks everyone who sends to Gmail addresses to set up SPF or DKIM, and recommends SPF, DKIM and DMARC for every domain. Emails that aren't authenticated might be marked as spam or rejected.

If your email is with us and your domain uses our name servers, DKIM is on automatically. Our standard SPF and DMARC records are on automatically for newer domains too. On an older domain, or on a domain that uses another host's name servers, check them or add them yourself, as the set-up steps below show.

Why are your emails going to spam?

Legitimate emails from your domain can end up in spam when the receiving server can't confirm they're yours. They can also land there when your recipients or your content make them look like spam. Check for these causes:

• Your domain has no SPF or DKIM record, so your emails aren't authenticated and the receiving server can't confirm they're yours.
• A newsletter tool or shop system sends from your domain but isn't in your SPF record, so its emails are more likely to be marked as spam.
• Your domain uses another host's name servers, and the records were added at a different host from the one that runs them.
• Recipients often report your emails as spam, so your later emails are more likely to land there too.
• Your email hides text with HTML or CSS, which might get it marked as spam.

Fix missing records, left-out senders and records at the wrong host in your DNS. Complaints and hidden content come down to who you send to and what you send. Email only people who asked to hear from you, and make it easy to unsubscribe. If it's junk in your own inbox that bothers you, here's how to stop spam emails reaching your own inbox.

How to set up DMARC, SPF and DKIM for your domain

Your domain's name servers are the servers that hold its DNS records, and a free WHOIS lookup of your domain shows whose they are. Where you set the records depends on who runs them, not on where you registered the domain. If your business email is with us, follow the route for your name servers below. If your email is with another provider, follow that provider's own guide for its SPF and DKIM records. Add your DMARC record wherever your name servers are. On our name servers, the provider's SPF value goes in a custom SPF record that replaces our standard one, so your domain keeps one SPF record. Keep our include, include:_custspf.one.com, in it for any email our servers still send for you.

If your domain uses our name servers

1. Leave your MX record as it is. It tells other mail servers where to deliver your email, and by default it already points to our mail servers.
2. There's nothing to do for DKIM. It's on automatically for email with us on our name servers.
3. Check that our standard SPF record is switched on, and switch it on if it's off.
4. Check our standard DMARC record the same way: make sure it's switched on, and switch it on if it's off.
5. If you want another policy or DMARC reports, create a custom DMARC record instead and start it on none, for example with the value v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.co.uk. It replaces the standard record, so your domain keeps a single DMARC record.

As with any DNS change, it often takes a few hours before every mail server sees it, and it can take up to 72 hours. You switch on the standard DMARC record, or create a custom DMARC record, in your DNS settings.

If your domain uses another host's name servers

These steps point your domain's email to us, so follow them only if your email is with us. Our SPF value is v=spf1 include:_custspf.one.com ~all. For a domain that hasn't been migrated, our MX record is your domain followed by .mx.one.com. For a migrated domain, our support gives you the full MX record.

1. Create your email address with us first.
2. At the host that runs your name servers, note down your current MX records. Then replace them with our MX record, so it's the only one left.
3. Add our SPF record there as a TXT record. If the domain already has an SPF record, merge ours into it instead, so the domain keeps one SPF record.
4. Add the DKIM records there as CNAME records, with the values our support gives you for your domain.
5. Give the change time to reach everyone. It often takes a few hours and can take up to 72 hours.
6. Send a test email to an address at another provider and check that it arrives.

At the same host, add a DMARC record as a TXT record named _dmarc. Give it the value v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.co.uk, with your own report mailbox after mailto:. This starts your policy on none and sends the reports to that mailbox.

How to run a DMARC check

A DMARC check shows whether your domain has a DMARC record and whether your emails pass it. To see the record, enter your domain in a free DMARC lookup tool.

To check a real email, send one to an address at another provider and open its full header (in Gmail: More, then Show original). The Authentication-Results line holds the result of each check. For DKIM, it should say something like dkim=pass, and for DMARC something like dmarc=pass.

A dmarc=fail means neither SPF nor DKIM passed for the domain in your From address, for example because the service that sent the email isn't in your SPF record or doesn't sign with DKIM for your domain.

What Google and Microsoft require from bulk senders

Google and Microsoft both have stricter rules for domains that send more than 5,000 emails a day to their users. Google calls these domains bulk senders.

If you run email marketing campaigns from your domain, check your set-up against these rules before a big send.

Frequently asked questions

What is BIMI and how do I get my logo next to my emails?

BIMI (Brand Indicators for Message Identification) publishes your logo in your domain's DNS, so mailbox providers that support it can show it beside your authenticated emails. Most providers that support it need DMARC at enforcement, meaning a policy of quarantine or reject, and a logo in a specific SVG format. Some providers also ask for a certificate that proves you have the rights to the logo. The certificate is a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC). Each provider decides when the logo is shown.

Does DMARC stop every spoofed email?

No. Not every receiving server checks DMARC records, so DMARC can't completely stop email that pretends to come from your domain, though it makes it harder. Our guide to email security covers how to protect your email accounts as well.

Start with your own domain: run the DMARC check above and switch on whatever is missing. If your business doesn't send from its own domain yet, choose an email plan with us. On our name servers, DKIM is on from the start.