SPF, DKIM and DMARC are three DNS-based standards that let receiving mail servers check whether a message really comes from your domain. Gmail, Yahoo and Microsoft now require them from bulk senders, and without them even normal business mail is more likely to land in spam. This guide explains what each one does and how they fit together.
Before you start
- Access to your domain's DNS zone (for MdmHost hosting: cPanel → Domains → Zone Editor).
- A list of every service that sends mail as your domain: your hosting server, a newsletter tool, a CRM, a helpdesk.
SPF: who may send for your domain
Sender Policy Framework is a TXT record listing the servers allowed to send mail using your domain in the envelope sender (Return-Path). Example:
v=spf1 +a +mx include:_spf.google.com ~allinclude:pulls in a provider's list.~all(softfail) or-all(fail) tells receivers what to do with everyone else.- Only one SPF record per domain, and at most 10 DNS lookups in total.
DKIM: a signature on every message
DomainKeys Identified Mail adds a cryptographic signature to the message headers. The sending server signs with a private key; the receiver fetches the public key from DNS at selector._domainkey.example.com and checks that the signed headers and body were not changed. cPanel creates a DKIM key for every domain, published as default._domainkey.
DMARC: the policy that ties them together
DMARC tells receivers what to do when a message fails, and where to send reports. It is a TXT record at _dmarc.example.com:
v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=rA message passes DMARC when SPF or DKIM passes and the passing domain aligns with the visible From address. Alignment is what stops a spammer from passing SPF with their own domain while showing yours in the From line.
How SPF, DKIM and DMARC work together
| Standard | Checks | Record location | Survives forwarding |
|---|---|---|---|
| SPF | Sending IP is authorised | TXT at the domain | Usually not |
| DKIM | Message is signed and unchanged | TXT at selector._domainkey | Usually yes |
| DMARC | SPF or DKIM aligns with From | TXT at _dmarc | Depends on DKIM |
Safe DMARC rollout plan
- Publish SPF covering every legitimate sender.
- Enable DKIM on your hosting and on each third-party service, using their CNAME or TXT records.
- Publish DMARC with
p=noneand aruaaddress to collect aggregate reports. - Read the reports for two to four weeks and fix any legitimate source that fails.
- Move to
p=quarantine, optionally withpct=25first, then top=reject.
Warning: Jumping straight to p=reject can silently block invoices or newsletters sent by a service you forgot to authorise.
How to check your records
- Send a message to a Gmail address, open it and choose Show original: you should see SPF, DKIM and DMARC all as PASS.
- In cPanel open Email → Email Deliverability to see whether the server's suggested SPF and DKIM records are installed.
Troubleshooting
- SPF PermError: two SPF records or more than 10 lookups. Merge them into one record.
- DKIM fails after a provider change: the selector record still holds the old key.
- DMARC fails while SPF passes: the service uses its own Return-Path domain, so SPF is not aligned. Enable DKIM signing with your domain on that service.
Frequently asked questions
Do I need all three?
Yes. SPF and DKIM authenticate, DMARC enforces and reports. Major mailbox providers expect all three from anyone sending regularly.
Should I use ~all or -all in SPF?
With DMARC in place, ~all is common and safe; DMARC decides the final action. Use -all for domains that never send mail.
What about domains that do not send email?
Publish v=spf1 -all and v=DMARC1; p=reject to stop them being spoofed.