If your business sends email from a custom domain, three DNS records quietly determine whether that mail is trusted: SPF, DKIM and DMARC. Here is what each one actually does.
SPF: Who is allowed to send mail for your domain
SPF (Sender Policy Framework) is a DNS TXT record listing which mail servers are allowed to send email on behalf of your domain. When a receiving mail server sees a message claiming to be from your domain, it checks the SPF record to see if the sending server is authorized. Without SPF, it is easier for someone else to send mail that appears to come from your domain.
DKIM: Proving the message was not altered
DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email, generated using a private key on your mail server and verified using a public key published in your DNS. If a message is altered in transit, or forged, the signature will not validate correctly.
DMARC: Telling receivers what to do
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving mail servers what to do if a message fails those checks — for example, to quarantine or reject it. DMARC can also be configured to send you reports about mail claiming to be from your domain.
Why all three matter together
SPF alone does not protect against forged “from” addresses in the way DMARC does. DKIM alone does not tell receivers what to do with a failed check. Configured together, and kept up to date as you add new sending services, they form the baseline for reliable business email authentication.
We configure SPF, DKIM and DMARC as part of every business email and self-hosted mail server setup we deliver. Talk to us if you are not sure your current setup is configured correctly.