Authentication
SPF, DKIM and DMARC Explained for Business Email
Quick Answer
SPF lists which servers can send mail for your domain, DKIM digitally signs messages to confirm they were not altered, and DMARC tells receiving servers what to do when SPF or DKIM fail. Together they help prevent spoofing and improve deliverability.
These three records work together rather than independently. Missing even one weakens the others: SPF without DMARC has no enforcement, DKIM without SPF leaves a gap, and DMARC without either has nothing to check.
Common Causes
- Only one or two of the three records configured, leaving gaps.
- SPF configured but missing "include:_spf.google.com" for Workspace mail.
- DKIM generated in the Admin console but never published in DNS, or signing never turned on.
- DMARC missing entirely, leaving receiving servers to apply default handling.
Safe Troubleshooting Steps
- Confirm an SPF record exists and includes "include:_spf.google.com".
- Generate a DKIM key in the Admin console, publish it in DNS, and turn on signing.
- Publish a DMARC record starting with a monitoring-only policy (p=none).
- Review results over a few weeks before moving to a stricter DMARC policy.
What to Verify
- SPF, DKIM and DMARC records all exist and are correctly published.
- A test message passes all three checks (visible in message headers).
When Professional Help May Be Useful
Getting all three set up correctly together, in the right order, is one of the most common requests we see, since a partial setup can sometimes cause more delivery issues than having none at all.