What are SPF, DKIM and DMARC? A plain-English guide
If your church newsletter or shop invoice lands in spam, start with the settings behind your email address. SPF, DKIM and DMARC help receiving mail services recognize legitimate senders. They are public notes in DNS, the address book for your domain. You do not need to memorize the initials to check them.
Three settings, three jobs
SPF is the guest list: it lists the services allowed to send mail using your domain in the message's behind-the-scenes return address. Your normal mailbox and another sending service may need different setup steps. SPF alone does not prove that the visible From address is genuine.
DKIM is a tamper-evident signature: your sending service signs the message, and a public key in DNS lets the receiver check that signature. Enable it at each sending provider, not just in DNS. Google Workspace and Microsoft 365 supply their own record values; a value you invent will not work.
DMARC is the instruction note: it asks receivers what to do when neither SPF nor DKIM passes with a domain matching the visible From address. That matching is called alignment; a related subdomain can qualify under the usual settings. One aligned passing method is enough for DMARC, though you should set up both SPF and DKIM.
Why it matters now
Gmail, Yahoo and Microsoft's Outlook.com have bulk or high-volume sender requirements that include SPF, DKIM and DMARC. Their volume definitions and other requirements differ; not every small office is a bulk sender. These settings still help smaller senders. Missing authentication can make mail more likely to be marked as spam or rejected, but authentication never guarantees an inbox place. Permission, complaints and easy unsubscribe options matter too.
Start DMARC gently
A policy of p=none asks for no special blocking because of DMARC failure. It is a normal, safe starting point while you identify legitimate senders. Reports are requested separately with a rua address; use a mailbox or reporting service you control and can review. Other spam checks still apply.
p=quarantine asks receivers to treat failing messages as suspicious, usually placing them in spam. p=reject asks receivers not to accept them. Receivers make the final decision. Do not jump to reject for a higher grade: first check reports and test real messages from every service, fix alignment problems, then move to quarantine and eventually reject when legitimate mail passes. Tightening too soon can block your own messages.
Common mix-ups
Publishing two SPF records at the same name does not combine them into a longer guest list; it makes SPF invalid. Keep one SPF record there. Save the old values, then combine only the services you actually use, following their instructions. SPF has a limit of 10 DNS lookups, including nested requests, so adding every suggested include is not a safe fix.
Remember Mailchimp, Constant Contact and any church management system that sends newsletters, receipts or reminders. Follow each service's domain-authentication instructions. Some use their own return-address domain for SPF and rely on your aligned DKIM signature; do not blindly add an SPF include. Publishing a DKIM record without enabling signing in the provider dashboard is another common mix-up.
What the free grade can tell you
GradeMyDNS checks public records, not delivered messages. DKIM under an unusual selector name may be missed; a published key or delegation does not prove signing is enabled for every sender. DMARC none earns partial points; quarantine and reject earn more, and requesting reports adds points. SPF ~all with DMARC can earn the same full sender-list score as -all. Fix safely rather than chasing points.
What to do
- Run the free check for your own domain and save the findings.
- List every service that sends for you. Get its exact authentication records from its dashboard.
- Find who manages DNS, save existing values, and change only the records required. Test real mail and review reports before tightening DMARC.