Skip to content
We Sort.

SPF, DKIM and DMARC for deliverability and anti-spoofing

Your domain is the bit after the @ in your email address, and the bit after www. in your website address. 

Behind every domain sits its DNS (Domain Name System): a public address book that computers read to find out how to handle that domain. It tells them which server hosts your website, which company receives your email, and more besides. You don't see it day to day, but it's managed wherever your domain is registered. 

Below I try to explain this system and provide some guidance on checking email you receive if you feel it’s suspicious.

NB: If someone needs to change your DNS for you, see sharing DNS access. 

Three entries in that address book help receiving mail servers decide whether an email really came from who it says it came from. They have unhelpful names, so here's what they mean.

A comment on r/sysadmin sums it up well:

SPF: These are the servers I will send from. If it says it's from me, but comes from somewhere else, it's likely fake.

DKIM: This is my signature, if it's not on the email, it probably didn't come from my server.

DMARC: If you get mail that doesn't match the above, here's what I want you to do with it.

That's nearly all of it. The missing piece is the bit that makes DMARC useful, so here's a slightly fuller version using a posted letter as the analogy.

SPF: the approved post offices

Sender Policy Framework. A record in your domain's DNS listing the servers allowed to send email for your domain. The receiving server checks the sending server's IP address against that list.

In the analogy: a company publishes a list of the post offices it sends its letters from. When a letter arrives, the mailroom checks which post office it came through. If it's not on the list, something's off.

The weakness: SPF checks the envelope, not the letterhead. A scammer can post from their own approved post office while printing someone else's name on the letter inside.

DKIM: the wax seal

DomainKeys Identified Mail. Your email provider adds a digital signature to every outgoing message using a private key. The matching public key sits in your domain's DNS, so the receiving server can confirm the signature is genuine and the message hasn't been altered.

In the analogy: the company stamps each letter with a seal only it can make, and publishes what that seal should look like. If the seal is intact and matches, the letter really came from that company and wasn't tampered with on the way.

The weakness: a seal proves who sealed the letter, not that it matches the name on the letterhead. A scammer can seal a letter with their own perfectly valid seal.

DMARC: the matching check, plus instructions

Domain-based Message Authentication, Reporting and Conformance. A record in your domain's DNS that requires SPF or DKIM to pass for the same domain shown in the From address, tells receiving servers what to do when that fails, and asks them to send you reports.

In the analogy: DMARC adds the rule that closes both loopholes. The post office or the seal must belong to the same name that's on the letterhead.

It then tells the receiving mailroom what to do with anything that fails:

  • none: let it through (useful while you're setting things up)

  • quarantine: put it in the junk pile

  • reject: bin it

It can also ask for reports, so the domain owner finds out who is sending email in their name.

Why this matters for your own email

These records don't just help other people spot fakes. They help your genuine email get delivered.

Since February 2024, Gmail has required every sender to have at least SPF or DKIM set up. Anyone sending more than 5,000 emails a day to Gmail addresses needs all three. Yahoo brought in matching rules at the same time, and Microsoft’s Outlook followed in 2025.

Most small businesses never send that volume, but the direction is clear. Email without these records is increasingly treated as suspicious, so it lands in spam or doesn't arrive at all. A common culprit is a newsletter tool, booking system or online shop sending email "from" your domain without being added to your SPF and DKIM.

Checking a suspicious email in Gmail

Open the message, click the three dots (⋮) at the top right, then Show original.

Gmail menu with the show original option.
Gmail interface for displaying an original email with pass for SPF DKIM and DMARC.

The summary table at the top is the useful bit.

  1. Look at the three results. SPF, DKIM and DMARC all showing PASS is the healthy picture.

  2. Check the domains match the From address. In the example above, DKIM passed for wesort.co.uk and the email is from ben@wesort.co.uk. That match is what matters. Be wary of an email "from PayPal" where DKIM passed for random-mailer.xyz.

  3. Check the From address itself. Lookalike domains such as paypa1.com, wesort-co.uk or wesort.co.uk.billing.net will pass every check, because the scammer owns that domain and has set it up properly.

  4. A DMARC fail on a big name (your bank, HMRC, Microsoft, a supplier) is a strong red flag. Don't click anything in it.

There's a quicker check without opening Show original. Click the small arrow under the sender's name and look at mailed-by and signed-by. Both should be the sender's real domain.

Gmail interface for mailed-by and signed by domains.

Two things to keep in mind

A pass doesn't mean it's safe. It only proves the email really came from the domain shown. If that domain is a lookalike, or a genuine account that has been hacked, everything passes. Hacked supplier accounts sending "our bank details have changed" invoices are common. For any change to payment details, phone the sender on a number you already have.

A fail doesn't always mean it's fake. Forwarded emails, mailing lists and badly configured small business email can all fail legitimately. Treat a fail as a reason to slow down, not as proof.