Domain·Hosting
🧭 Hosting wizard · 2026

Email Auth: SPF/DKIM/DMARC

SPF, DKIM, and DMARC are three email authentication standards that prove messages come from your domain. Without them, receiving servers are more likely to reject your email or send it to spam. SPF lists authorised senders, DKIM signs each message, and DMARC defines policy when checks fail. The tool on this page tests all three at once.

Email Auth: SPF/DKIM/DMARC

Four questions, no email address
What are you putting online
Visits a month you expect in year one

A guess is fine. It only decides whether an entry plan has room, not what you pay.

How you feel about a terminal
What an unexpected bill would mean
Copied

Closest fit

    Every class, ranked

      This is a category, not a company. Any host selling that category can serve you well or badly; the checks below are how you tell them apart.

      Before you pay, check these four things

        What Each Standard Does

        SPF (Sender Policy Framework, RFC 7208) is a TXT record listing the IP addresses and servers allowed to send email on behalf of your domain. When a receiving server gets a message claiming to be from your domain, it checks the sending IP against your SPF record. A mismatch flags the message as potentially forged.

        DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to each outgoing message. Your mail server signs with a private key; the receiving server retrieves your public key from a special TXT record in DNS and verifies the signature. If the message was altered in transit, verification fails.

        DMARC (Domain-based Message Authentication, Reporting, and Conformance, RFC 7489) ties SPF and DKIM together. It tells receiving servers what action to take — none, quarantine, or reject — when a message fails both SPF and DKIM alignment. DMARC also provides reporting, sending you daily summaries of who is sending email using your domain.

        Setting Them Up in the Right Order

        Start with SPF because it requires only a single TXT record and immediately reduces the chance of your legitimate email being flagged. Your email provider will give you the exact value to add. A common starting record looks like v=spf1 include:_spf.provider.example ~all, where the include directive authorises your provider's servers and ~all soft-fails everything else.

        Add DKIM next. Your email provider generates the key pair and gives you a TXT record to publish under a specific subdomain selector. This step is usually copy-paste — the complexity is handled on the provider side.

        Add DMARC last, once SPF and DKIM are in place and verified. Begin with a policy of p=none to collect reports without affecting delivery, review the reports for a few weeks to confirm legitimate mail passes, then tighten to p=quarantine or p=reject. Jumping straight to reject without a monitoring period risks blocking your own email.

        All three records are published as TXT entries in your domain's DNS. If you have already set up your MX records, adding these is the natural next step to protect your email reputation.

        Next in this cluster

        Related guides and tools

        Built and maintained by Mustafa Bilgic · Independent — no host or registrar is named, ranked or recommended ·

        Sources

          SPF per RFC 7208. DKIM per RFC 6376. DMARC per RFC 7489. Record format examples follow each RFC's recommended syntax.
        • Every figure in the calculators on this site is typed in by you. No price, allowance or renewal rate is stored in the page.