Short answer: SPF, DKIM and DMARC are three records published in a domain’s DNS settings. SPF lists which mail servers are allowed to send email for the domain. DKIM adds a digital signature to each email so the receiver can confirm it was not forged or altered. DMARC ties the two to the address the reader sees, tells receiving mail systems what to do with email that fails, and sends reports back to the domain owner. Together they are called email authentication, and email sent without them is far more likely to be treated as suspicious.
- SPF: a public list of the servers allowed to send mail for your domain.
- DKIM: a signature on each message that proves it is genuine and unchanged.
- DMARC: the policy that says what happens when a message fails, plus reporting.
Why does email need authentication at all?
Email was designed without any built-in way to prove who sent a message. Anyone can write an email and put your company’s address in the “From” line, much as anyone can write any return address on an envelope. Criminals use this to send fake invoices and password requests that appear to come from real businesses.
SPF, DKIM and DMARC were added over time to close that gap. Each is a short piece of text published in a domain’s DNS, the public directory that tells the internet where a domain’s website and email live. When an email arrives, the receiving mail system looks up these records and uses them to decide whether the message is really from the domain it claims to be from.
For a business owner, this matters in two ways. It protects your name from being used by impostors. And it affects whether your own email, including any outreach sent for you, reaches the inbox. Authentication is one of the main factors in cold email deliverability.
What does each of SPF, DKIM and DMARC do?
| Record | What it does | Plain comparison |
|---|---|---|
| SPF | Lists approved sending servers | A guest list at the door |
| DKIM | Signs each message | A tamper-proof seal |
| DMARC | Sets the policy and reporting | Instructions to the doorman |
SPF: who is allowed to send
SPF stands for Sender Policy Framework. An SPF record is a list of the mail servers and services that are permitted to send email for a domain. If your company sends mail through one email provider and an invoicing system, both should appear in the record.
When a message arrives, the receiving system checks whether the server it came from is on that list. If it is, SPF passes. If it is not, SPF fails. One detail is worth knowing: SPF checks a technical return address that is hidden from the reader, not the “From” address shown in the email. On its own, then, SPF does not prove that the visible sender is genuine. A domain should also have only one SPF record. Publishing two is a common mistake that causes the check to fail.
DKIM: is the message genuine and unchanged
DKIM stands for DomainKeys Identified Mail. The sending system adds a digital signature to every email, created with a private key that only the sender holds. The matching public key is published in the domain’s DNS. The receiving system uses the public key to check the signature.
If the check passes, two things are confirmed: the message was signed by someone with authority over that domain, and the signed parts of the message were not changed on the way. Unlike SPF, a DKIM signature normally survives when an email is forwarded, which is one reason both are used together.
DMARC: what to do when checks fail
To answer the question “what is DMARC” in one sentence: it is the record that connects SPF and DKIM to the address the reader actually sees, and tells receivers what the domain owner wants done with mail that fails. DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
A message passes DMARC when it passes SPF or DKIM, and the domain that passed matches the domain in the visible “From” address. This matching is called alignment, and it is what stops an impostor from passing the checks with a domain of their own while showing yours to the reader.
The DMARC record also states a policy. There are three choices.
- None: take no special action, but send reports. This is a monitoring mode.
- Quarantine: treat failing mail as suspicious, which usually means the spam folder.
- Reject: refuse failing mail outright.
The policy is a request. Receiving systems generally honor it, but they make the final decision.
How do SPF and DKIM work together with DMARC?
Each record covers a gap left by the others. SPF checks the sending server but not the visible sender, and it can break when mail is forwarded. DKIM checks the message itself but, alone, says nothing about what to do if the signature is missing. DMARC requires that at least one of them passes for the visible domain, and gives a clear instruction when neither does.
Put simply: SPF and DKIM are the tests, and DMARC is the rule about how the tests are graded and what happens after a failure. A domain with all three set up correctly gives receiving systems a firm basis for trusting its mail. A domain with none gives them nothing to go on.
Passing authentication does not guarantee the inbox. It proves who sent the email, not that the email is wanted. Reputation, list quality and content still decide where the message lands.
What is DMARC monitoring?
A DMARC record can name an address to receive reports. Receiving mail systems send regular summaries to that address showing which servers sent mail using your domain and whether those messages passed or failed. DMARC monitoring means collecting and reading those reports.
The reports are written for machines, so most organizations use a service to turn them into something readable. They are useful for two things: spotting a legitimate system of yours that is failing authentication, and spotting someone else sending mail in your name. The usual path is to start with a policy of none, read the reports until every genuine source passes, and then move to a stricter policy.
How can you check your SPF, DKIM and DMARC records?
You do not need access to anything to check SPF and DMARC, because the records are public. Enter a domain into our free MX check tool and it will show the mail records it finds. You are looking for three things: one SPF record, a DMARC record with a policy, and DKIM in place for each service that sends your mail. DKIM is harder to look up from outside, because each sending service publishes its key under its own label.
A second check is to send yourself an email and view the message’s original headers in your mail program. Most mail systems add a line showing whether SPF, DKIM and DMARC passed or failed for that message.
If anything is missing or failing, the fix is made in your domain’s DNS settings, normally by whoever manages your domain or your email. It is a small job for someone who knows it, and a risky one to guess at, since a wrong SPF record can cause your real email to fail.
What should you ask an outreach provider about authentication?
If a provider sends cold email for you, it will usually do so from separate sending domains, and each of those domains needs its own records. Ask these questions.
- Are SPF, DKIM and DMARC set up on every sending domain before launch? All three, not one or two.
- Can I see that they pass? A provider should be able to show you a test result.
- Who reads the DMARC reports? If nobody does, the monitoring is not doing anything.
- Will you need to change anything on my main domain? If so, ask exactly what and why before agreeing.
Want the technical setup done properly and explained plainly? Tell us who you want to reach, and we will walk you through what gets set up before a campaign sends. Talk to Next Reply →
Authentication is the first step. After it come your email reputation, inbox placement testing, and the tracking domain your links use.
Frequently asked questions
Do I need all three records?
Yes, in practice. SPF and DKIM each cover weaknesses in the other, and DMARC is what links them to the address your reader sees. A domain that sends email should have all three.
Will setting up SPF, DKIM and DMARC stop my emails going to spam?
It removes one common reason for landing in spam, but it is not a cure. Authentication proves identity. Whether mail is wanted is judged separately, on reputation, list quality and content.
Can a wrong record break my email?
Yes. An SPF record that leaves out a service you really use, or a strict DMARC policy applied before every genuine sender passes, can cause real email to be rejected. That is why changes should be made carefully and tested.
Does Next Reply set up authentication?
Sending infrastructure setup is included in every Next Reply plan. Next Reply does cold email only. It does not offer cold calling, LinkedIn outreach, paid ads or SEO.
Want outreach sent from a properly authenticated setup?
Next Reply is a done-for-you cold email agency for B2B companies. Every plan includes list building, sending infrastructure setup, copy, follow-ups and monthly reporting, and a campaign goes live in 14 days. Compare the plans or tell us who you want to reach.