Email Authentication SPF DKIM DMARC Explained

Email authentication using SPF, DKIM, and DMARC is the process of verifying that an email message genuinely comes from the domain it claims to use, helping prevent spoofing and phishing. You set up three DNS records (SPF, DKIM, and DMARC) that receiving mail servers check to decide whether to accept, quarantine, or reject a message. This article explains what each record does, how they work together, and how to configure them correctly for your domain.

Formula

The SPF specification (RFC 7208) limits the number of DNS lookups a single SPF record can cause to 10. Each mechanism that requires a DNS query (like include:, a:, mx:, or ptr:) counts toward that limit. The formula is simple:

Remaining lookups = 10 − (number of SPF mechanisms that trigger a DNS lookup)

Variables:

• SPF record limit – the fixed maximum of 10 lookups per RFC 7208.
• Number of SPF mechanisms – the count of include:, a:, mx:, and similar terms in your SPF TXT record.

The result shows how many more lookups you can add before your SPF record becomes invalid and causes all mail from your domain to fail SPF checks.

Worked Example

Using the default values: a typical SPF record for a small business that uses its own mail server and one email marketing service might look like:

v=spf1 mx include:_spf.example.com ~all

Here, mx counts as one lookup and include: counts as another, so the number of mechanisms is 2. The calculator gives:

• Remaining lookups = 10 − 2 = 8
• Percent of budget used = (2 / 10) × 100 = 20%

If you add two more include: statements (for a second email service and a CRM), the count becomes 4, leaving 6 lookups. The limit is per receiving server evaluation, not per record, so every include: chain counts cumulatively.

Why Email Authentication Matters

Before SPF and DKIM, anyone could send an email that appeared to come from your address. Phishing attacks rely on this spoofing to trick recipients into revealing passwords or transferring money. Email authentication gives receiving servers a way to check two things: is the sending server authorized (SPF) and is the message content unchanged since it was signed (DKIM). DMARC then tells the receiver what to do if those checks fail.

Without these records, your domain is an open target. Attackers can impersonate you to customers, partners, or employees. With them, you gain visibility into who is sending mail using your domain and you can instruct receivers to reject fraudulent messages.

How SPF Works

SPF (Sender Policy Framework) is a DNS TXT record that lists the IP addresses or hostnames allowed to send email for your domain. When a receiving server gets a message, it looks up your SPF record and checks the sending server’s IP against the list.

A basic SPF record looks like:

v=spf1 ip4:192.0.2.10 include:_spf.google.com ~all

• v=spf1 – identifies the record as SPF version 1.
• ip4:192.0.2.10 – allows that specific IP to send.
• include:_spf.google.com – pulls in Google’s SPF record for Workspace users.
• ~all – soft-fail: any server not listed is not authorized, but the message is still accepted (marked as suspicious). Use -all for hard fail (reject).

The critical rule is the 10-lookup limit. Every include:, a:, mx:, or ptr: mechanism adds a DNS query. If you exceed 10, the SPF check returns permerror, which causes SPF to fail even for legitimate senders. Many email services (like Mailchimp, Salesforce, or Zendesk) each require their own include:, so you can hit the limit quickly.

How DKIM Works

DKIM (DomainKeys Identified Mail) uses public-key cryptography. Your sending server signs each outgoing message with a private key. The public key is published in a DNS TXT record under a selector name, like default._domainkey.yourdomain.com.

The receiving server retrieves the public key, decrypts the signature, and verifies that the message headers and body have not been altered in transit. If the signature matches, DKIM passes.

A DKIM TXT record looks like:

default._domainkey TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

Each email service provider gives you a unique selector and public key to add to your DNS. Unlike SPF, there is no lookup limit for DKIM, but you must ensure the selector is correct and that the key is active. Keys can expire or be rotated, so check with your provider if DKIM fails.

How DMARC Ties Them Together

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a policy that tells receiving servers what to do when both SPF and DKIM fail. It also provides a reporting mechanism so you can see who is sending mail using your domain.

A DMARC record is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

• p= – policy: none (monitor only), quarantine (send to spam), or reject (block the email).
• rua= – the email address that receives aggregate XML reports.
• pct= – percentage of messages to apply the policy to (start at 10, then increase).

DMARC passes if either SPF or DKIM passes and the domain in the From header matches the domain used in SPF or DKIM. This alignment requirement is key: even if SPF passes for your sending service, if the From address is your domain but the SPF check uses a different domain, DMARC fails.

How to Choose Your DMARC Policy

Start with p=none to collect data. After two weeks, review the reports to see which legitimate services are sending mail. If you see failures from services you use, fix their SPF or DKIM records first. Then move to p=quarantine for a few weeks, and finally to p=reject once you are confident all legitimate mail passes.

Common reasons for DMARC failure:

• SPF passes but the From domain does not match the envelope sender domain (alignment failure).
• DKIM signature uses a domain different from the From domain.
• You forgot to add SPF include: for a new email service.
• Your SPF record exceeds the 10-lookup limit, causing a permanent error.

Common Problems and Misconceptions

“I have SPF and DKIM, so I don’t need DMARC.� Without DMARC, receivers may still deliver spoofed mail that passes SPF or DKIM but is not aligned. DMARC is the only way to enforce rejection.

“SPF is enough.� SPF fails when mail is forwarded, because the forwarding server’s IP is not in your SPF record. DKIM survives forwarding, which is why you need both.

“My SPF record has more than 10 lookups but works.� It may work for some receivers, but many will reject or mark it as suspicious. The limit is hard in the spec.

“I can just use ~all and not worry.â€� Soft-fail tells receivers to accept but flag. Attackers can still deliver spam to the inbox on many systems. Use -all only after confirming all legitimate senders are listed.

Costs and Maintenance

Setting up SPF, DKIM, and DMARC costs nothing beyond your DNS management time. The records themselves are free to publish. The main cost is ongoing maintenance: every time you add a new email service, you must update SPF and DKIM. DMARC reports can be large and technical; many domain owners use free or paid parsers to read them.

There is no standard “expiry� for these records, but keys and selectors change when you switch providers. Review your DMARC reports monthly to catch new unauthorized senders.

Frequently Asked Questions

What is the difference between SPF and DKIM? SPF verifies the sending server’s IP address is authorized by the domain. DKIM verifies the message was signed by the domain and not altered. They are independent; a message can pass one and fail the other.

Can I have multiple SPF records? No. If you publish more than one SPF TXT record, receiving servers will return a permerror and SPF will fail. Combine all mechanisms into a single record.

How long does it take for DNS changes to work? Typically minutes to a few hours, but propagation can take up to 48 hours depending on TTL values. Use a DNS lookup tool to confirm the record is visible before testing email.

What does “alignmentâ€� mean in DMARC? Alignment means the domain in the From header must match the domain used in the SPF envelope sender or the DKIM signing domain. You can set adkim=r (relaxed) or aspf=r to allow subdomains, but strict alignment is safer.

Should I use ~all or -all in SPF? Start with ~all (soft fail) to avoid blocking legitimate mail while testing. Once you are sure every authorized sender is listed, switch to -all (hard fail) for stronger protection.

What if I use a third-party email service like Gmail or Outlook? You must add their include: statements to your SPF record and publish their DKIM keys. Each provider has documentation with the exact DNS records to add.

Related

• Voltage Conversion Calculator: Volts, Millivolts and More
• Natural Gas Heating Cost Calculator: Estimate Your Bill
• Power, Current, and Voltage Calculator: How It Works

in t | SPF record limit | number of lookups | 10 | 1 | 10
in d | Number of SPF mechanisms | count | 5 | 1 | 10
out remaining | Lookups left before limit | lookups | 10 - d | 0
out percent_used | SPF lookup budget used | % | (d / 10) * 100 | 0