What are SPF, DKIM and DMARC?
Short answer
They are DNS records that help receiving mail servers decide whether email claiming to come from your domain is genuine. SPF lists servers allowed to send for you, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail and sends you reports.
The details
Together they make it much harder for criminals to send email that exactly spoofs your domain. Google’s sender guidelines expect them, and bulk senders must publish DMARC. Start DMARC at p=none to collect reports, fix legitimate senders, then move to quarantine and reject.
Useful next reads and tools
Terms explained
- DKIM
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify it came from an authorized sender for the domain and was not altered in transit.
- DMARC
- DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.
- SPF
- SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for a domain.
Sources
Related questions
- How do I stop someone from spoofing my email domain?
- How do I read email headers to check if a message is fake?
- What are HTTP security headers and which ones should my website have?
- How can I check if my website is secure?
- What is a DDoS attack and how do I protect a website from one?
- How do I secure a WordPress website?
Related Guides
GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideWeb Security
How to Prevent a DDoS Attack (Step-by-Step Guide for 2026)
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideWeb Security
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): How to Patch, Mitigate and Detect Attacks
Two critical PHP flaws allow unauthenticated remote code execution. See who is affected, the fixed versions, temporary mitigations and what to watch for in your logs.
Read more