---
title: SPF, DKIM, and DMARC Explained | SendHQ
description: A plain-language explanation of the DNS records that establish email authentication and alignment.
canonical: https://sendhq.cc/guides/email-dkim-spf-dmarc
last-updated: 2026-08-24
---
# SPF, DKIM, and DMARC Explained

A plain-language explanation of the DNS records that establish email authentication and alignment.

SPF, DKIM, and DMARC are complementary. SPF authorizes servers, DKIM signs messages, and DMARC checks that the visible From identity aligns with authenticated signals.

## What this means in practice

- SPF: which servers may send
- DKIM: a cryptographic message signature
- DMARC: alignment and receiver policy
- DNS records as the source of truth

## Implementation checklist

1. Publish provider-authorized SPF mechanisms carefully.
2. Add the DKIM CNAME or TXT records your provider supplies.
3. Deploy DMARC with monitoring before enforcement.
4. Review aggregate reports and tighten policy only when aligned mail is stable.

## Questions teams ask

**Can I have more than one SPF record?**

No. Combine mechanisms into one SPF record; multiple SPF TXT records can cause authentication failures.

**What DMARC policy should I start with?**

Start with monitoring (\`p=none\`) while reviewing aligned traffic, then move gradually to quarantine or reject when ready.

## Continue learning

- [Email API: Send, Receive, and Track Transactional Email](https://sendhq.cc/guides/email-api.md): Understand what an email API does, how sending and inbound receiving work, and what to evaluate before choosing one.
- [Transactional Email API Guide](https://sendhq.cc/guides/transactional-email-api.md): A practical guide to sending passwords, receipts, alerts, and other product-triggered email reliably.
- [How to Send Email with an API](https://sendhq.cc/guides/send-email-with-api.md): A step-by-step approach to authenticated API email sending, testing, and production safety.
- [How to Receive Email with an API](https://sendhq.cc/guides/receive-email-with-api.md): Route inbound mail to your application, parse it safely, and make it useful in a product workflow.
- [Email Domain Verification: SPF, DKIM, and DMARC](https://sendhq.cc/guides/email-domain-verification.md): What domain verification is, why it matters, and how SPF, DKIM, and DMARC work together.