08 Nov 2026
SPF, DKIM and DMARC are three DNS records that prove your emails really come from you. Together they stop attackers from sending email as your domain and help your real emails land in inboxes instead of spam.
Gmail and Yahoo now require authentication from bulk senders, and many Indian banks and enterprises expect it from suppliers. This guide shows what each record does, example values and a safe rollout plan.
| Record | What it does | Simple analogy |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | Guest list at the door |
| DKIM | Adds a digital signature to each email | Tamper-proof seal on the envelope |
| DMARC | Tells receivers what to do if SPF or DKIM fails, and sends you reports | Security guard's instructions |
SPF is a TXT record on your domain. A typical example for Microsoft 365 looks like this:
v=spf1 include:spf.protection.outlook.com -all
DKIM keys are generated by your email provider. You publish the public key as a DNS record (often a CNAME or TXT under a selector such as selector1._domainkey).
DMARC is a TXT record at _dmarc.yourdomain. Start in monitoring mode, read reports, then tighten.
| Stage | Example record | Goal |
|---|---|---|
| Monitor | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com | See who sends as you |
| Quarantine | v=DMARC1; p=quarantine; pct=25; rua=… | Start filtering failures |
| Reject | v=DMARC1; p=reject; rua=… | Block spoofed email fully |
Most companies move from none to reject in 6 to 12 weeks, after fixing every legitimate sender found in reports.
Attackers love spoofing unused domains because no one watches them. For every domain that never sends mail, publish:
This includes defensive and redirect domains. See defensive domain registration.
| Problem | Likely cause | Fix |
|---|---|---|
| SPF permerror | More than 10 DNS lookups | Flatten or remove unused includes |
| DKIM fail | Key not published or wrong selector | Republish the key from your provider |
| DMARC fail for CRM mail | Third-party sender not aligned | Set up custom DKIM for that service |
| Mail goes to spam | No DMARC or no DKIM | Complete all three records |
| Two SPF records | Added by different teams | Merge into one record |
Client: Digital lending fintech, Bengaluru
Challenge: Customers received fake loan emails from the company's real domain.
What we did: SPF and DKIM fixed for all senders, DMARC moved from none to reject over six weeks, reject records on unused domains.
Results:
Client: Engineering manufacturer, Hyderabad
Challenge: Invoices from the ERP system landed in customer spam folders.
What we did: Added the ERP sender to SPF, set up DKIM for it, published DMARC at none and then quarantine.
Results:
SPF, DKIM and DMARC are free, take a few hours to set up and close one of the most abused gaps in business email. Start with monitoring, fix your senders and move to reject.
Need help? Flying Stars sets this up as part of email security, business email solutions and domain protection services.
