DKIM, SPF, and DMARC Explained: The Complete Guide for Email Senders

Understand DKIM, SPF, and DMARC authentication for email. Step-by-step guide to setting up all three records and fixing deliverability issues.

Inbox placement starts with authentication. Gmail, Outlook, and Yahoo reject or defer unauthenticated email at significant rates. DKIM, SPF, and DMARC are not optional for serious senders.

SPF — Sender Policy Framework

SPF tells receiving mail servers which IP addresses are authorized to send email for your domain. It works as a DNS TXT record on your sending domain.

A basic SPF record:

v=spf1 ip4:198.51.100.0/24 include:sendgrid.net ~all

The ~all softfail means emails from unauthorized sources are accepted but flagged. Use -all for a hard fail once you are confident your record is complete.

Common SPF mistake: The 10 DNS lookup limit. SPF allows a maximum of 10 DNS lookups per evaluation. SPF flattening resolves this by replacing includes with their resolved IP addresses.

DKIM — DomainKeys Identified Mail

DKIM adds a cryptographic signature to every email you send. The receiving server uses your public key (published in DNS) to verify the signature. If the signature validates, the email provably came from your server and was not altered in transit.

DKIM involves two components:

  • Private key — stored on your mail server, used to sign outgoing mail
  • Public key — published in DNS as a TXT record at selector._domainkey.yourdomain.com

A 2048-bit RSA key is the current minimum recommended size. Rotate keys every 6–12 months.

DMARC — Domain-based Message Authentication, Reporting and Conformance

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also enables reporting — you receive daily XML aggregate reports showing authentication results.

A DMARC record is published at _dmarc.yourdomain.com:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100; adkim=s; aspf=s

Policy values:

  • p=none — monitor only, no enforcement. Start here.
  • p=quarantine — failing mail goes to spam folder.
  • p=reject — failing mail is rejected outright. This is the goal.

DMARC Alignment

DMARC requires either SPF or DKIM to align with the From header domain.

  • Strict alignment (s): Exact match required
  • Relaxed alignment (r): Subdomain match allowed

How TurboMTA Handles All Three

TurboMTA signs outgoing mail with DKIM (RSA-2048 keys, with multiple selectors per domain) and guides you through the SPF, DMARC and reverse-DNS records that mailbox providers expect. With our free setup we give you the exact DNS records for your domain, or apply them when you open a ticket with DNS access.