DKIM, SPF, and DMARC: The Complete Email Authentication Guide for 2026

In February 2024, Google and Yahoo made email authentication mandatory for bulk senders. If you send more than 5,000 emails per day, you must have SPF, DKIM, and DMARC configured — or your emails will be rejected or land in spam.

But even if you send fewer emails, these three protocols are essential for deliverability. They prove to inbox providers that your emails are genuinely from you and haven't been tampered with in transit.

In this guide, I'll explain what each protocol does, how they work together, and how to set them up correctly — even if you're not a technical expert.

The Three Pillars of Email Authentication

Think of email authentication like airport security:

All three work together. SPF without DMARC is like having a passport but no immigration officer checking it. DKIM without DMARC is a seal that nobody looks at.

SPF: Sender Policy Framework

What SPF Does

SPF is a DNS TXT record that lists the IP addresses and servers authorized to send email on behalf of your domain. When a receiving mail server gets an email from you@yourdomain.com, it checks your domain's SPF record to confirm the sending server is authorized.

How to Set Up SPF

Add a TXT record to your domain's DNS settings:

Type: TXT
Host/Name: @ (or yourdomain.com)
Value: v=spf1 include:_spf.google.com include:sendgrid.net ~all

Breakdown of the syntax:

Common SPF Mistakes to Avoid

• Multiple SPF records: You can only have ONE SPF record per domain. If you have two, both become invalid.
• Too many DNS lookups: SPF has a limit of 10 DNS lookups per check. Use tools like spf-record.com to validate.
• Using +all: This authorizes anyone to send as your domain — the opposite of what you want.
• Forgetting to include third-party senders: Your ESP, CRM, helpdesk, and any other tool that sends email from your domain.

DKIM: DomainKeys Identified Mail

What DKIM Does

DKIM adds a digital signature to every outgoing email. The receiving server uses your public key (published in DNS) to verify that the email wasn't modified in transit and genuinely came from your domain.

How to Set Up DKIM

Most email providers generate DKIM keys for you. Here's the typical process:

1. Generate keys in your email provider's dashboard (Google Workspace, Brevo, SendGrid, etc.)
2. Add the DNS record they provide:

Type: TXT
Host/Name: google._domainkey.yourdomain.com  (varies by provider)
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...

3. Enable DKIM signing in your provider's settings
4. Verify using a DKIM checker tool

DKIM Selectors

The "selector" (google, s1, smtp, etc.) is an identifier that tells the receiving server which DKIM key to use. Your ESP provides the selector — it's part of the DNS hostname:

<selector>._domainkey.yourdomain.com

You can have multiple DKIM selectors for different services (e.g., google._domainkey for Google Workspace, s1._domainkey for your ESP).

DKIM Best Practices

• Use a 2048-bit key minimum. 1024-bit keys are no longer considered secure.
• Rotate keys periodically (every 6–12 months)
• Ensure your ESP is actually signing emails with DKIM before adding the DNS record

DMARC: Domain-based Message Authentication, Reporting & Conformance

What DMARC Does

DMARC is the policy layer that ties SPF and DKIM together. It tells receiving servers:

1. What to check (SPF, DKIM, or both)
2. What to do if the check fails (do nothing, quarantine, or reject)
3. Where to send reports about authentication results

How to Set Up DMARC

Add a TXT record to your domain:

Type: TXT
Host/Name: _dmarc.yourdomain.com
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; pct=100

Policy levels (p=):

Recommended rollout path:

1. Start with p=none and rua (aggregate reports) for 1–2 weeks
2. Review DMARC reports to identify unauthorized senders
3. Move to p=quarantine for another 1–2 weeks
4. Move to p=reject once you're confident all legitimate senders pass

How the Three Work Together

When you send an email, here's what happens at the receiving server:

1. SPF Check: "Is the sending server IP in the SPF record?"
   → PASS or FAIL

2. DKIM Check: "Does the DKIM signature match the public key in DNS?"
   → PASS or FAIL

3. DMARC Check: "What should I do based on SPF/DKIM results?"
   → NONE: Deliver normally
   → QUARANTINE: Send to spam folder
   → REJECT: Block entirely (bounce)

For DMARC to pass, at least ONE of SPF or DKIM must pass AND align with the sending domain. This means:

• If SPF passes but DKIM fails → DMARC can pass
• If DKIM passes but SPF fails → DMARC can pass
• If both fail → DMARC fails

Testing Your Authentication Setup

Use these free tools to verify your configuration:

1. Google Admin Toolbox CheckMX: Go to https://toolbox.googleapps.com/apps/checkmx/ and enter your domain
2. MXToolbox: Check SPF, DKIM, and DMARC individually at https://mxtoolbox.com/
3. DMARC Analyzer by Dmarcian: Upload DMARC reports for detailed analysis
4. Send a test email to check-auth@verifier.port25.com — it replies with a detailed SPF/DKIM/DMARC report

Common Mistakes That Break Authentication

1. Forgetting to Update SPF When Changing ESPs

When you switch from Mailchimp to Brevo (or any ESP), update your SPF record to include the new provider AND keep the old one during transition.

2. DKIM Key Too Short

1024-bit DKIM keys are deprecated. Google and Microsoft may reject them. Always use 2048-bit minimum.

3. DMARC rua Email Doesn't Exist

The rua address receives aggregate XML reports. If this mailbox doesn't exist or is full, you lose visibility into authentication failures.

4. SPF PermError (Too Many Lookups)

Each include:, a, mx, and ptr mechanism counts as a DNS lookup. The limit is 10. If you exceed it, SPF fails with a PermError — which means it's treated as if it doesn't exist.

Solution: Use a hosted SPF flattening service or consolidate your includes.

Key Takeaways

• SPF + DKIM + DMARC are mandatory for bulk senders (Google/Yahoo requirement since Feb 2024)
• Start with p=none, monitor for 2 weeks, then move to p=quarantine then p=reject
• Verify your setup using Google CheckMX, MXToolbox, or Port25's test address
• One SPF record only — multiple records invalidate both
• 2048-bit DKIM keys or higher
• Check your email list with a verifier to ensure you're not sending to invalid addresses — authentication is only half the equation; list quality is the other half