< Back

SPF, DKIM, and DMARC Records

I have a lot of people ask me about this, so I felt like it'd be useful to put together a resource!

Some terms:

SPF (Sender Policy Framework) Record: A piece of information stored along with a domain lookup that tells other computers what servers are authorized to send email on behalf of that domain name.

DKIM (Domain Key Identified Mail) Record: A piece of information stored along with a domain lookup that gives a digital signature that can only be decrypted by a certain key value provided to verify that an email supposedly coming from a domain is from who it says its from.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) Record: A piece of information stored along with a domain lookup that sets a policy on how to handle suspicious emails from a particular domain—either do nothing, quarantine, or reject the email and return to sender.

IP Address: A unique location identifier for a specific computer, used to route traffic through the internet. These are usually mapped to a domain name or domain names whose files they're hosting.

These records have been introduced due to the fact that it's relatively easy to set your sender address saying you're from any given server for spam or fraud purposes, so there needed to be a way to verify the origin of an email. These records are available to mail servers that check your domain registry information.

As such, many email providers have started requiring at minimum SPF and DKIM records in order to accept email—GMail, in fact, has started requiring it as of February 2024. Servers that don't set up these records will see a lot of their emails either sent to spam or bouncing, and potentially end up on email blacklists.

You can use an email proxy service like Mailgun, Postmark, or like a zillion other services that exist now; you can also just generate your own records. You'll need access to your domain registrar and to find the section where you manage what's called "Zone Records," which route specific types of traffic on your web server. Zone records tell traffic what address to go to in order to find your main site, subdomains, your mail servers, and so on.

All three of these types of records are entered as TXT records, which are used to store miscellaneous information about your domain. Enter them as separate records, save, and you'll see the updates after somewhere between 5 minutes and 48 hours. (The time can vary wildly for people based on the route their traffic takes to the website—it's like how people around a city will have different travel times to a certain location.)