What are SPF, DKIM and DMARC? A plain-English guide

Anyone can drop a letter in the mail with your business’s name in the corner. The post office has no way of knowing whether you really sent it. Email started out the same way, and scammers took full advantage.

These three settings fix that. Each one answers a different question that Gmail and Outlook ask about every email claiming to be from you.

SPF answers “was this email sent by someone you trust?” It’s a short list, kept on your domain, of the services allowed to send email for you: your mailbox, your invoicing tool, your newsletter.

Picture a front desk with a list of approved couriers. A courier who isn’t on the list gets turned away, or at least looked at closely. When you start using a new tool and forget to add it, its emails show up without their name on the list, and that’s often why they land in spam.

Two things trip people up. Your domain can only have one of these lists, and the list can only name about ten services before it stops working. A second list, or a list that’s grown too long, breaks the whole thing.

DKIM answers “is this email really from you, and did it arrive unchanged?” Each email your tools send carries a hidden digital seal. Gmail and Outlook check it against a key on your domain. If the seal matches, the email is genuine and nobody tampered with it on the way.

It works like a wax seal with your stamp pressed into it. Anyone can write a letter, but only you have the stamp. Each tool you use sets up its own seal for you through its “verify your domain” or “authenticate your domain” setting.

DMARC answers “what should we do with email that fails, and do you want to know about it?” It’s a note you leave for Gmail, Outlook and others. It does three jobs.

1. 1
   It checks the names match. Passing the first two checks isn’t enough on its own. The seal or the approved sender has to be in your name, not just the tool’s. (A courier with a valid badge from their own company doesn’t prove you sent the letter.)
2. 2
   It says what to do with failures. Start in watch-only mode, which changes nothing. Later you can turn it up so failures go to junk, and finally so they’re blocked.
3. 3
   It sends you reports. Every day, Gmail, Outlook and others report every service that sent email using your address, and whether it passed. That’s how you find tools you forgot about, and anyone pretending to be you.

Each one covers a gap in the others. SPF alone breaks when someone forwards your email, because the forwarder isn’t on your list. DKIM alone doesn’t tell Gmail what to do when the seal is missing. Neither one checks that the email was sent in your name rather than the tool’s. DMARC ties them together and adds the reports, but it has nothing to check without the other two.

Google and Microsoft now expect them too. Since February 2024, Gmail has required every sender to pass SPF or DKIM, and businesses sending more than 5,000 emails a day to Gmail need all three. Microsoft added the same rule for Outlook.com, Hotmail and Live addresses in May 2025.

1. 1
   Run the free check below. It looks up all three on your domain and tells you, in plain English, which are missing.
2. 2
   List every tool that sends email for you, then turn on each one’s “verify your domain” setting.
3. 3
   Add DMARC in watch-only mode, read the reports for a couple of weeks, and only then turn it up.

Want the long version of fixing them? The business email going to spam guide walks through it, and the section for your IT person has the exact settings.