Glossary · Domains, DNS, email and certificates

What are SPF, DKIM and DMARC?

SPF, DKIM and DMARC are DNS records that authenticate email: SPF lists the servers allowed to send for a domain, DKIM signs each message with a key published in DNS, and DMARC tells receivers what to do with mail that fails.

How it works and why it matters

SPF (RFC 7208) is a TXT record on the domain itself. A domain may have only one, and checking it may take at most 10 DNS lookups; going over makes SPF fail.

DKIM (RFC 6376) adds a signature to each message. Receivers fetch the public key from selector._domainkey.example.com and check that the message wasn’t changed. DMARC (RFC 7489) lives at _dmarc.example.com: a message passes when SPF or DKIM passes for the domain in the visible From address, and the policy, p=none, quarantine or reject, says what to do with the rest.

Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024. Without them, order confirmations and password resets land in spam or are refused, and anyone can send mail that looks like it came from you.

Example

example.com.         TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine"

How Uptimecheck helps

Uptimecheck domain monitors check the domain’s MX, SPF, DKIM, DMARC and MTA-STS records twice a day, say what to fix with a ready-made DNS record where one fixes it, and alert you when a new problem appears, such as a second SPF record.

See Email authentication monitoring

Set it up How to check SPF, DKIM and DMARC

Start free trial Try the live demo

14-day free trial · No credit card required

Questions

Do I need all three?

Yes, in practice. DMARC builds on SPF and DKIM, and the large mailbox providers expect all three from anyone who sends in volume.

Which DMARC policy should I use?

Start with p=none, which changes nothing for delivery, fix every legitimate sender that fails, then move to p=quarantine and finally p=reject.

Why does my SPF record fail with too many lookups?

Each include, a, mx, exists and redirect counts toward a limit of 10 DNS lookups. Remove services you no longer use, or replace an include with the addresses it stands for, carefully.

Downtime is obsolete.

Set up your first monitor in under a minute, or look around the live demo first.

Start free trial Compare plans