SPF, DKIM and DMARC explained
These three records are how the rest of the internet decides your email is really from you. Get them right and you land in the inbox; get them wrong and you can silently block your own mail.
Anyone on the internet can put your address in the From line of an email. These three DNS records are how receiving servers tell your real mail from a forgery — and how you stop someone invoicing your patients in your name.
What each one does
| SPF | Lists which servers are allowed to send mail for your domain. A published list of your legitimate senders. |
|---|---|
| DKIM | Adds a cryptographic signature to each message so the receiver can prove it was not altered and really came from you. |
| DMARC | Tells receivers what to do when SPF and DKIM fail, and asks them to send you reports. Without it the other two are advisory. |
All three are TXT records in your DNS. None of them affect your website.
SPF
An SPF record is a single line listing your senders:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
Each include: delegates to a provider’s own list. The ending matters:
~all— soft fail. Anything not listed is suspicious but usually still delivered. The safe default.-all— hard fail. Anything not listed should be rejected outright. Stronger, but it will block any sender you forgot.
One SPF record per domain. Two records is a permanent error — receivers stop evaluating and everything fails. If you add a service, merge its include: into the record you already have.
Ten DNS lookups, maximum. Each include: costs a lookup and nested ones count too. Go over and SPF hard-fails for everyone. Drop providers you no longer use.
Before switching to -all, list every system that sends as your domain: your mail host, your newsletter tool, your EHR’s patient reminders, your booking system, your website’s contact form, your scanner. Practices routinely forget the last three.
DKIM
Your mail provider generates a key pair, keeps the private half, and gives you a public half to publish at a selector hostname such as default._domainkey.yourpractice.com. Outgoing mail is signed; receivers look up the public key and check the signature.
You do not have to understand the cryptography. You do have to actually publish the record — a surprising number of domains have DKIM switched on at the provider and no matching DNS record, which achieves nothing.
DMARC
DMARC ties the other two together. A starting record:
v=DMARC1; p=none; rua=mailto:dmarc@yourpractice.com
The p= policy is the whole point, and you move through it in stages:
p=none — watch
Change nothing about delivery, but start receiving reports about who is sending as your domain. Run this for at least two to four weeks.
Read the reports
They will show senders you forgot. Add the legitimate ones to SPF and DKIM. This is the real work, and the reason not to skip ahead.
p=quarantine — filter
Failing mail goes to spam rather than the inbox. Start at
pct=25if you want to ease into it, then raise it.p=reject — enforce
Failing mail is refused outright. This is the setting that actually stops people impersonating your practice.
Checking what you have
From a terminal:
dig +short TXT yourpractice.com — look for the line starting v=spf1
dig +short TXT _dmarc.yourpractice.com — your DMARC policy
dig +short TXT default._domainkey.yourpractice.com — DKIM, if that is your selector
Prefer a browser? Any “DMARC checker” or “MX toolbox” style site reports all three at once.
FAQ
Will setting these up interrupt our email?
SPF and DKIM are safe to add. DMARC at p=none changes nothing about delivery — it only collects reports. The risk only appears at quarantine and reject, which is why you get there in stages.
We use Gmail and a newsletter tool. Do we need two SPF records?
No — one record with two include: entries. Two separate SPF records is an error that breaks authentication entirely.
The DMARC reports are unreadable XML. Is that normal?
Yes, they are machine-readable by design. Point rua= at a free DMARC report analyser, or send them to us and we will summarise what is actually sending as your domain.
Does this stop someone spoofing our domain completely?
DMARC at p=reject stops forgeries that use your exact domain in the From address. It does not stop lookalike domains — yourpractlce.com with an L. That is a training problem: see Spotting phishing at the front desk.