SPF, DKIM, DMARC: Email Authentication Explained Simply

If you’ve ever set up a custom domain for email and been told to add a few oddly-formatted DNS records, you’ve run into SPF, DKIM, and DMARC - three separate but related standards that, together, are what stops anyone on the internet from freely sending email that claims to be from your domain.

What each one actually checks

• SPF (Sender Policy Framework) - a DNS TXT record listing which mail servers are authorized to send email for your domain. When a message arrives, the receiving server checks the sending server’s IP address against this list; if it’s not on it, the message looks forged.
• DKIM (DomainKeys Identified Mail) - a cryptographic signature added to outgoing mail. The receiving server verifies the signature using a public key published in DNS, confirming the message wasn’t altered in transit and genuinely came from an authorized sender - a stronger, more tamper-resistant check than SPF alone.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) - tells receiving servers what to actually do when SPF or DKIM checks fail: ignore it, quarantine it (send to spam), or reject it outright - and where to send reports about failures, so you can see who’s trying to spoof your domain.

Why DKIM is the odd one out to check

SPF and DMARC always live at a fixed, predictable DNS location for any domain. DKIM doesn’t - its record’s location depends on a “selector” chosen by whoever configured mail for that domain, and there’s no DNS record that reveals what selector is in use. If you know your provider’s selector, you can check it directly; otherwise, checking tools typically try selectors commonly used by default by major providers (Google Workspace, Microsoft 365, Mailchimp, SendGrid, and others). Finding nothing doesn’t necessarily mean DKIM isn’t configured - just that it’s not using one of the common defaults.

Checking a domain’s setup

Our SPF, DKIM & DMARC Checker looks up all three for any domain and explains what each result actually means in plain language, rather than just dumping raw DNS records.

The connection to deliverability

Misconfigured or missing email authentication doesn’t just risk spoofing - it can directly hurt whether your own legitimate email gets delivered at all, contributing to the kind of reputation problems that get an IP address listed on a spam blocklist. If your email is landing in spam without an obvious reason, checking authentication and blocklist status together usually explains it.