Email

SPF, DKIM, DMARC: stop people sending email in your name

Published on 22 October 2026 · David Serreau

Anyone can write an email with your address as the sender. What stops them is three records in your domain's DNS zone.

The three settings, one sentence each

• SPF: the list of servers allowed to send email for your domain.
• DKIM: a signature added to every email, proving it really comes from you and was not altered on the way.
• DMARC: the instruction given to receiving mail services when a suspicious email uses your name (let it through, send it to spam, reject it), plus the address where reports are sent.

Why it became mandatory in practice

Since 1 February 2024, Gmail requires SPF or DKIM authentication from all senders; those sending more than 5,000 messages a day must have SPF, DKIM and DMARC. Without them, your quotes and invoices may end up in spam.

Check your own domain

• A TXT record starting with v=spf1 on your domain: that is your SPF. It should end with -all or ~all, and there must be only one.
• A TXT record on _dmarc.your-domain starting with v=DMARC1. p=none only monitors; p=quarantine or p=reject actually protects.
• DKIM: your email provider gives you a key to publish; it is checked using the “selector” the provider tells you.

Common mistakes

• Two SPF records instead of one: both become invalid.
• A sending tool (newsletter, invoicing) left out of SPF: its emails fail.
• DMARC left at p=none for years: you watch, but nothing is blocked.

Moving to p=quarantine is done in steps: read the reports first, to be sure all your legitimate mail passes.

Sources

checked on 22 October 2026

• Google, email sender guidelines