DKIM, SPF and DMARC
The three records that authenticate your emails, explained plainly.
Three acronyms, one idea: prove to mail providers that an email claiming to come from your domain actually does. All three are simple DNS records — text lines published at your domain registrar.
SPF — who is allowed to send
SPF (Sender Policy Framework) is the list of servers authorized to send email on behalf of your domain. It is a TXT record that starts with v=spf1.
example.com. TXT "v=spf1 include:amazonses.com ~all"When an email arrives, the recipient's mail provider checks that the server that sent it is on that list. An unknown server triggers suspicion of spoofing.
DKIM — the mail signature
DKIM (DomainKeys Identified Mail) is a cryptographic signature added to every email. Your domain publishes a public key in DNS; the sending server signs each message with the corresponding private key.
The recipient's mail provider verifies the signature: if the content was altered in transit, or if the signature does not match the published key, verification fails. It is also the strongest proof that the email genuinely came from your domain.
In Mailcheer, DKIM takes the form of 3 CNAME records published on <selector>._domainkey.your-domain.com — the wizard generates them for you.
DMARC — the policy for failures
DMARC (Domain-based Message Authentication, Reporting and Conformance) is your policy: what should a mail provider do when an email claiming to come from your domain fails the SPF/DKIM checks? It is a TXT record published on _dmarc.your-domain.com:
_dmarc.example.com. TXT "v=DMARC1; p=none;"Three possible policies:
| Policy | Meaning |
|---|---|
p=none | Take no action, only monitor. The recommended starting point. |
p=quarantine | Send suspicious emails to spam. |
p=reject | Reject them outright. |
Even with p=none, the mere presence of a DMARC record matters: Gmail and Yahoo have required it for bulk senders since 2024.
The three together
- SPF says who can send.
- DKIM proves the message is authentic and intact.
- DMARC says what to do on failure — and locks alignment with your visible domain.
The domain verification wizard publishes all three. To check an existing domain, use the public tester.