If email is central to your business, understanding the protocols that keep it trustworthy is essential. SPF, DKIM, and DMARC were designed to reduce spam and prevent sender spoofing. They matter for both senders and receivers.
For receivers, these standards help filter out spam, phishing, and other harmful messages. For senders, a solid understanding of how they work protects you from inadvertently failing authentication checks and having legitimate mail blocked.
SPF (Sender Policy Framework)
SPF is an open standard designed to prevent sender address forgery. It exists as a DNS TXT record that explicitly lists which mail servers and IP addresses are authorized to send email for a given domain. If a receiving server detects that the sending server isn't on that list, it can block or flag the message.
DKIM (DomainKeys Identified Mail)
Like SPF, DKIM is published as a DNS TXT record. But in addition to verifying the signing domain, DKIM also confirms that the message content and headers haven't been modified in transit. It does this using an asymmetric key pair: the private key signs outbound messages on the sending server, and the public key is published in DNS for receivers to verify.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC ties SPF and DKIM together. It lets senders publish a policy in DNS that tells receivers what to do with messages that fail both SPF and DKIM alignment: deliver them, quarantine them, or reject them outright. One aligned pass is enough, so a forwarded message that breaks SPF still passes DMARC if its DKIM signature survives. It also includes a reporting mechanism, so senders receive aggregate data on which messages passed or failed authentication, giving visibility into both legitimate traffic and potential abuse of your domain.
Do You Need All Three?
For anyone sending at volume, all three are now a hard requirement. Google and Yahoo have required SPF, DKIM, and DMARC from bulk senders since February 2024, and Microsoft followed on May 5, 2025, rejecting non-compliant bulk mail outright with a 550 5.7.515. Google draws its bulk line at 5,000 messages a day to Gmail accounts, and Yahoo publishes no equivalent number, so treat 5,000 as Google's figure. Below that line the rules are looser, but the direction is set, and receiving systems keep tightening. None of the three are expensive or technically complex to deploy, and the protection they provide is well worth the effort.
For a focused introduction to DMARC specifically, including the DNS record format and policy modes, see What Is DMARC and Why Is It Important?.
To verify your records are correctly published, Mr. DNS offers free SPF, DKIM, and DMARC checkers. For TLS configuration on your mail server, GoodTLS has production-ready settings for Postfix, Exim, and other common MTAs. And because an expired certificate breaks mail submission on ports 587 and 465, along with any delivery covered by MTA-STS enforce mode or DANE, keep an eye on renewals with SSL certificate monitoring.
Strong authentication lowers your blacklisting risk, but doesn't eliminate it. Generator Labs monitors your sending infrastructure against hundreds of blacklists, so you know immediately if something goes wrong.