Guide / sender identity

SPF, DKIM and DMARC work as a set.

Updated August 2026 · 9 min read

SPF says which servers may send. DKIM signs a message. DMARC tells receivers what to do when identity checks do not align.

SPF is a publishing limit

Publish one SPF TXT record for a domain and include only services that genuinely send mail. SPF has DNS lookup limits; stacking multiple SPF records is invalid. Keep the policy short and documented.

DKIM adds a verifiable signature

Your sending provider creates a private key and publishes the matching public key at a selector hostname. The selector lets multiple systems sign without replacing one giant record. Never publish private key material.

DMARC begins with observation

Start with p=none and a reporting address you control. Review reports, fix legitimate senders, then consider quarantine or reject. Alignment matters: the visible From domain should align with SPF or DKIM under your chosen mode.

Rollout rule: authentication policies affect deliverability. Change one sender at a time and retain a rollback note. Use the checker to inspect public TXT values, but validate behavior with real test messages.

For inbound routing, see MX records explained.