SPF, DKIM and DMARC explained: what to publish in 2026

SPF lists the servers allowed to send for your domain (RFC 7208). DKIM signs each message so changes in transit can be detected (RFC 6376). DMARC ties both to the visible From address and tells receivers what to do on failure (RFC 9989). Google, Yahoo and Microsoft require all three from bulk senders.

Each one checks a different domain in the same message, which is why one can pass while another fails:

DMARC's specification changed in May 2026. RFC 9989 replaced RFC 7489 and dropped the pct tag, which was usually not applied accurately except at 0 or 100. Google's DMARC guide still tells you to ramp up with it.

What SPF does and the record to publish

SPF is a TXT record at the domain it covers. Receivers check it against the envelope sender, the MAIL FROM address of the SMTP conversation (RFC 7208, section 2.4). It never reads the From address a person sees, and any domain owner, even a bad actor, can get an SPF pass for its own domain.

yourdomain.com  TXT  "v=spf1 include:_spf.google.com include:amazonses.com ~all"

That is Google Workspace plus Amazon SES, the example in Google's SPF guide. include: hands the check to another domain's record. ~all sets the result for every other server. The qualifiers are - fail, ~ softfail, ? neutral and + pass.

The SPF limit of 10 DNS lookups

A receiver may run at most 10 DNS-querying terms while it evaluates your record: include, a, mx, ptr, exists and redirect. ip4, ip6 and all are free. Includes nested inside your includes count too, and the check that needs an 11th lookup returns permerror (RFC 7208, section 4.6.4). Four includes are enough to get there:

To get back under, delete includes for services you no longer use, or move a sender to its own subdomain, which needs its own record and has its own count. Flattening includes into ip4 and ip6 ranges also works, until a provider changes its addresses.

SPF mistakes that break the record

• Two SPF records on one name. The result is permerror (section 4.5). Merge them.
• An include for a domain with no SPF record. That also gives permerror for the whole record.
• Expecting subdomains to inherit. Publish a record for every name you send from.
• Ending in +all. It passes any IP.

What DKIM does and the record to publish

The sending system signs each message with a private key. The DKIM-Signature header names the signing domain (d=), the selector (s=) and the signed headers (h=) (RFC 6376, section 3.5). The receiver fetches the public key from selector._domainkey.domain and checks the signature against the body and those headers.

google._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=<base64 public key from your sender>"

google is Google Workspace's default selector. For any other sender, read the s= value in a test message's DKIM-Signature header. An empty p= means the key is revoked.

DKIM key length and rotation

• Length. Signers must use RSA keys of at least 1024 bits, should use 2048, and must not sign with rsa-sha1 (RFC 8301). Google requires 1024 bits or more for mail to personal Gmail accounts and recommends 2048.
• Rotation. M3AAWG recommends rotating at least every six months: publish a new selector, switch signing to it, keep the old key published for 7 to 30 days, then empty its p=. It strongly discourages reusing selector names.

DKIM mistakes that break verification

• A long key split wrong. A 2048-bit key does not fit in one 255-octet TXT string, so it is published as several strings that receivers join with no spaces.
• A selector mismatch. If the message says s=s1 and you published selector1, there is no key to find.
• Changes after signing. Anything that rewrites the body or a signed header breaks the signature, and mailing lists can do that. Google does not require alignment for forwarded or mailing list mail.

What DMARC does

DMARC is a TXT record at _dmarc.yourdomain.com. A message passes when SPF or DKIM passes for a domain that aligns with the From domain. Receivers look for the record at the From domain first, then at its organizational domain.

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

The tags, from section 4.7 of RFC 9989:

Alignment: why SPF can pass and DMARC still fail

Relaxed alignment asks for the same organizational domain, strict for an identical one, and nearly all domain owners find relaxed sufficient.

The last row is the platform's bounce domain from the header at the top. Set your domain up as the authenticated sending domain at each platform, so its DKIM d= is yours. One aligned pass is enough, but the RFC recommends using both, and Google says alignment with both is likely to become a requirement.

Aggregate reports

Receivers that send reports should send them at least once a day, as gzipped XML, so read them with a parser or a reporting service. A rua address at another domain counts only if that domain publishes v=DMARC1 at yourdomain.com._report._dmarc.reportdomain.com (RFC 9990, section 4).

In what order do receivers check them?

SPF can run as soon as the sending server gives its envelope address. DKIM and DMARC need the whole message, so they run after it arrives:

Passing is no promise of the inbox. A receiver may still reject or quarantine a message that passes DMARC, and Google also asks every sender for valid reverse DNS, TLS and a spam rate under 0.3%.

What Gmail, Yahoo and Microsoft require

Google, Yahoo and Microsoft all ask bulk senders for SPF, DKIM, a DMARC record of at least p=none, and a From domain aligned with SPF or DKIM. Thresholds, dates and bounce codes for each are in the bulk sender guide.

How to roll out DMARC without losing mail

1. List every system that sends as your domain. Google's SPF guide names web servers, mail servers, contact forms and third-party providers.
2. Publish SPF for those senders only, ending in ~all.
3. Turn on DKIM at each sender with your own domain, and let both run for at least 48 hours before DMARC.
4. Publish p=none with rua. The RFC calls this monitoring mode, because in all but the most trivial setups a sender gets overlooked.
5. Fix every legitimate stream the reports show failing. That can take many months.
6. Move to p=quarantine, then decide on p=reject. Domains whose people post to mailing lists should not publish p=reject, and a domain that does must sign with DKIM and not rely on SPF alone.

To check your work, query each record from a public resolver:

dig +short TXT yourdomain.com @1.1.1.1
dig +short TXT google._domainkey.yourdomain.com @1.1.1.1
dig +short TXT _dmarc.yourdomain.com @1.1.1.1

Then send yourself a test message and paste its headers into the header analyzer to read the SPF, DKIM and DMARC results. For the rest of the setup, see the 2026 deliverability checklist, and run the free email domain checker on your domain.