Email infrastructure guide

SPF, DKIM, and DMARC Explained

A plain-language explanation of the DNS records that establish email authentication and alignment.

SPF, DKIM, and DMARC are complementary. SPF authorizes servers, DKIM signs messages, and DMARC checks that the visible From identity aligns with authenticated signals.

What this means in practice

  • SPF: which servers may send
  • DKIM: a cryptographic message signature
  • DMARC: alignment and receiver policy
  • DNS records as the source of truth

Implementation checklist

  1. Publish provider-authorized SPF mechanisms carefully.
  2. Add the DKIM CNAME or TXT records your provider supplies.
  3. Deploy DMARC with monitoring before enforcement.
  4. Review aggregate reports and tighten policy only when aligned mail is stable.

Questions teams ask

Can I have more than one SPF record?

No. Combine mechanisms into one SPF record; multiple SPF TXT records can cause authentication failures.

What DMARC policy should I start with?

Start with monitoring (`p=none`) while reviewing aligned traffic, then move gradually to quarantine or reject when ready.

Continue learning

Email API: Send, Receive, and Track Transactional EmailUnderstand what an email API does, how sending and inbound receiving work, and what to evaluate before choosing one.Transactional Email API GuideA practical guide to sending passwords, receipts, alerts, and other product-triggered email reliably.How to Send Email with an APIA step-by-step approach to authenticated API email sending, testing, and production safety.How to Receive Email with an APIRoute inbound mail to your application, parse it safely, and make it useful in a product workflow.Email Domain Verification: SPF, DKIM, and DMARCWhat domain verification is, why it matters, and how SPF, DKIM, and DMARC work together.