What Are SPF, DKIM, and DMARC?
SPF, DKIM, and DMARC are DNS records that prove email from your domain is genuine. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature to each message. DMARC tells receiving servers what to do with mail that fails these checks, and sends you reports about who is sending as your domain.
Together they stop attackers from spoofing your domain in phishing emails and help your legitimate emails reach the inbox.
This Is For You If...
Customers received phishing emails that looked like they came from you
Your transactional or marketing emails land in spam
Gmail, Yahoo, or Outlook started rejecting or flagging your emails
You send through several services and aren't sure all are authenticated
A security questionnaire asked about DMARC enforcement
Email Authentication Records
Record | What It Does | Common Problem |
SPF | Lists servers allowed to send for your domain | More than 10 DNS lookups, which breaks SPF |
DKIM | Signs messages so they can't be altered | Missing for some sending services |
DMARC | Sets policy for failed mail and sends reports | Left at p=none forever, so spoofing isn't blocked |
MTA-STS and TLS-RPT | Require encrypted delivery to your domain | Not set up at all |
BIMI | Shows your logo in supporting inboxes | Requires DMARC enforcement first |
Sender Requirements from Major Providers
Since February 2024, Gmail and Yahoo require bulk senders, roughly 5,000 or more messages a day to their users, to have SPF, DKIM, and a DMARC policy, with aligned domains, one-click unsubscribe, and spam complaint rates below 0.3%. Microsoft introduced similar requirements for Outlook.com in May 2025. Smaller senders still need SPF or DKIM, and DMARC is strongly recommended.
What We Do
Audit
Find every service that sends email as your domain: Google Workspace, Microsoft 365, your app, CRM, marketing tools, and support desk.
SPF & DKIM Setup
Correct SPF records within lookup limits, and DKIM keys of 2048 bits for each sending service.
DMARC Rollout
Start at p=none to collect reports, fix every legitimate sender, then move to quarantine and reject without losing real email.
Report Monitoring
Read DMARC aggregate reports to spot spoofing attempts and misconfigured senders.
Advanced Protection
MTA-STS, TLS-RPT, and BIMI for stronger delivery security and brand visibility.
Subdomain Strategy
Separate subdomains for marketing and transactional email, so one doesn't hurt the other's reputation.
Common Mistakes to Avoid
Instinct | Why It Doesn't Help | Do This Instead |
Jumping straight to p=reject | Legitimate emails from forgotten services get blocked | Start at p=none, fix senders, then enforce |
Adding every service to one SPF record | Too many lookups make SPF fail | Flatten or split SPF and use subdomains |
Setting DMARC to p=none and stopping | Spoofing is reported but not blocked | Move to quarantine and reject |
Ignoring DMARC reports | You miss spoofing and broken senders | Monitor reports regularly |
What You Get
A full inventory of services sending as your domain
SPF, DKIM, and DMARC set up correctly
DMARC moved to enforcement on a safe timeline
MTA-STS and BIMI where they fit
DMARC report monitoring setup
Documentation for adding new sending services
How It Works
1. Audit
Find every sender and check current DNS records
2. Authenticate
Set up SPF and DKIM for each sender
3. Monitor
Publish DMARC at p=none and collect reports
4. Fix
Resolve failing legitimate senders
5. Enforce
Move DMARC to quarantine, then reject
Why Codersarts
We set up email for applications as well as office tools, so transactional email from your product, through services such as SendGrid, Amazon SES, Postmark, or Mailgun, is authenticated correctly too. See Cloud Security for the wider cloud review.
Turnaround Time
SPF, DKIM, and initial DMARC setup takes 1 to 3 working days. Moving safely to full DMARC enforcement usually takes 2 to 6 weeks of monitoring.
FAQ
What does DMARC p=reject mean?
It tells receiving servers to reject email that fails authentication for your domain. It's the strongest protection against spoofing.
Will DMARC break our email?
Not if it's rolled out in stages. Starting at p=none shows which legitimate services fail before anything is blocked.
Do small businesses need DMARC?
Yes. Attackers spoof small businesses too, and providers increasingly expect DMARC from every sender.
Does this improve deliverability?
Usually, yes. Authenticated, aligned email is more trusted by Gmail, Yahoo, and Outlook, though content and sending reputation also matter.
Is our project kept confidential?
Yes. Your data, code, and results stay confidential, and an NDA is available on request.
Related Services
Can Someone Send Email as Your Domain Today?
Check it, fix it, and enforce it safely.