SPF, DKIM and DMARC explained simply (and how to check yours in five minutes)

Three acronyms come up whenever deliverability is discussed: SPF, DKIM, DMARC. They are often set up once by copying lines found in a hosting provider's help centre, then forgotten. Until the day emails start going to spam and nobody is quite sure what was put in place.

These three mechanisms nevertheless answer a simple question that every server receiving your email asks itself: "does this message really come from who it claims to come from?" Without a clear answer, the message is treated as suspicious.

Why it has become mandatory

For a long time, these records were strongly recommended. They are now required. In February 2024, Gmail and Yahoo required bulk senders to have valid SPF and DKIM, a published DMARC policy, a one-click unsubscribe link and a low complaint rate. Microsoft announced comparable requirements for Outlook.com, enforced from May 2025.

The official thresholds apply to large senders, but in practice a domain without proper authentication will see its messages filtered well before it reaches those volumes. For prospecting, the three records should be treated as the minimum.

SPF: the list of authorised servers

SPF (Sender Policy Framework) is a line published in your domain's DNS. It says: "emails from this domain can only be sent from these servers." When a receiving server gets a message claiming to come from your domain, it checks that the sending server is on the list.

An SPF record looks like this:

v=spf1 include:_spf.mail.hostinger.com ~all

Read it from left to right: the version, then the authorised servers (here those of your hosting provider), then what to do with the rest. The final "~all" asks recipients to treat other servers with suspicion without rejecting them, which is a cautious choice.

The most common errors:

• two SPF records on the same domain: this is not allowed, and the result becomes invalid. You need to merge the two into a single line;
• a forgotten service: you also send invoices from third-party software, but it is not on the list;
• too many "include" entries: SPF is limited to ten DNS lookups. Beyond that, the record fails.

DKIM: the message signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. The sending server signs with a private key, and the corresponding public key is published in your DNS. The recipient verifies the signature: if it is valid, they know the message really comes from your domain and has not been altered along the way.

The public key is found at a specific DNS address, built using a "selector" chosen by your hosting provider, for example:

hostingermail1._domainkey.votredomaine.fr

This is where most DKIM problems hide: a key copied incompletely (they are long), a selector that differs from the one the server actually uses, or a key that was never published because the hosting provider was waiting for manual activation. The only reliable check is to send a real email and look at its header when it arrives.

DMARC: what to do if authentication fails

DMARC (Domain-based Message Authentication, Reporting and Conformance) links the previous two together. It asks the receiving server: "if a message claims to come from my domain but fails SPF and DKIM, here is what you should do with it." It also lets you receive reports on messages sent in your name.

A starting DMARC record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@votredomaine.fr

"p=none" means: block nothing, but send reports. This is the minimum policy required by Gmail and Yahoo, and a good starting point. Once you are sure that all your legitimate sends pass authentication, you can move to "p=quarantine" (send unauthenticated messages to spam), then possibly "p=reject".

A subtle point: DMARC requires that the domain authenticated by SPF or DKIM be the same as the one that appears in the From address. This is called alignment. An email sent from paul@yourdomain.fr but DKIM-signed by your hosting provider's technical domain may pass DKIM and still fail DMARC.

Check your records in five minutes

You do not need to be a system administrator. Three checks are enough:

1. Check your domain's TXT records with an online DNS lookup tool. You should find a single line that starts with "v=spf1", and a "v=DMARC1" line at _dmarc.votredomaine.fr.
2. Send an email from the mailbox concerned to a personal Gmail address, open it and view the original message. Gmail clearly shows "SPF: PASS", "DKIM: PASS" and "DMARC: PASS", along with the domain used for each.
3. Check that the domain shown for DKIM is actually yours, not your hosting provider's.

In SmartOutbound, this check is done automatically: each domain is checked every day, a test email sent when a mailbox is connected confirms the DKIM signature actually seen on arrival, and the "Check DNS" button on the mailboxes page reruns the check on demand. If DMARC is missing and your domain is with Hostinger, the tool can even add it for you.

And what about the rest?

These three records do not guarantee that your emails will land in the inbox. They only guarantee that they will not be rejected for an avoidable technical reason. The rest depends on your domain's reputation, the quality of your lists and the content of your messages. For new domains, you also need to allow for the warm-up period. And if you are unsure about prospecting from your main domain, our article on the dedicated domain will help you decide.