DNS and Domain ToolsSPF, DKIM and DMARC basics
Three TXT records tell the world which mail servers may send email for your domain.
SPF: who may send
An SPF record is a TXT record at the domain itself. It starts with v=spf1 and lists the servers allowed to send mail for the domain. RFC 7208 gives this example: v=spf1 +mx a:colo.example.com/28 -all, which has three directives. The final -all means that all other servers are not authorized. RFC 7208 also says that implementations should limit "void lookups" (lookups that find nothing) to two, and that going over the limit gives a "permerror" result.
DKIM: a signature
With DKIM (RFC 6376), the sending server adds a digital signature to each message. The public key that checks it sits in DNS, in a TXT record at selector._domainkey.yourdomain. A selector is a name that allows several keys to exist at once; the RFC gives office names or dates as examples. Your mail provider tells you the selector and the value to publish.
DMARC: what to do with failures
DMARC (RFC 7489) tells receivers what to do when SPF and DKIM do not line up with the From address. The record is a TXT record at _dmarc.yourdomain. The p tag sets the policy:
| p= | Meaning |
|---|---|
| none | No specific action requested (use it to start collecting reports) |
| quarantine | Treat failing mail as suspicious (for example, put it in the spam folder) |
| reject | Ask receivers to reject failing mail |
The version tag v=DMARC1 must come first. You can look at a big domain's record with the DNS lookup tool: _dmarc.google.com.
A safe way to start
- Set up SPF and DKIM at your mail provider and test that your mail passes.
- Publish DMARC with
p=noneand an address for reports. - Read the reports for a few weeks, fix senders that fail, then move to
quarantineandreject.
Do I need all three?
Large mail providers expect them for bulk mail. Use at least SPF and DKIM for any domain that sends email.
Can there be two SPF records?
No: a domain should have one SPF record. Combine the servers into one.
Sources
- RFC 7208: Sender Policy Framework (rfc-editor.org/rfc/rfc7208)
- RFC 6376: DomainKeys Identified Mail Signatures (rfc-editor.org/rfc/rfc6376)
- RFC 7489: DMARC (rfc-editor.org/rfc/rfc7489)
Read on 14 November 2026.
This is an independent guide. It is not connected with Cloudflare, Google, ICANN, IANA, GitHub or any registry named here. Facts were read on 14 November 2026 from the documents named on each page. Lookups are made from your browser to the services named in the result.