SPF, DKIM & DMARC in Plain English

The three DNS records that make your email believable — what each does, the classic mistakes, and when to move DMARC past p=none.

Free · no signup · last reviewed August 29, 2026

Part of Cold Email Infrastructure, the Honest Version

Three DNS records decide whether receiving servers believe your email is really from you. Missing them doesn’t make delivery impossible — it makes your domain forgeable, and filters treat forgeable senders accordingly.

SPF — who may send

A TXT record listing the servers authorized to send mail for your domain (your mail host, your marketing platform). One record per domain; multiple senders share it via include: entries. The classic mistake is adding a second SPF record instead of extending the first — that invalidates both.

DKIM — proof it wasn’t altered

Your sending service signs each message cryptographically; the public key lives in your DNS. Receivers verify the signature. Each sending platform provides its own DKIM record — add every one you actually send through.

DMARC — the policy that makes them count

DMARC tells receivers what to do when SPF/DKIM fail: p=none (just report), p=quarantine (spam-folder it), p=reject (refuse it). Our recommendation: start at p=none to collect reports, confirm every legitimate sender passes, then move to quarantine or reject — a p=none left forever is a smoke detector with no batteries, and bulk-sender rules at the big providers now expect DMARC on any domain sending volume.

Verify all three in one shot with the deliverability checker.

This is the work. Want it done?

Everything here is free to use yourself — that’s the point. If you’d rather a senior marketer just handle it, in your accounts and your name: 20-minute call, no pitch deck.

Contact