Contact
What are you interested in?
SPF, DKIM and DMARC.
SPF, DKIM and DMARC are three entries in a domain's DNS that receiving mail servers use to check whether an email really comes from the stated sender. They protect against forged senders (spoofing) and help decide whether mail lands in the inbox or in spam.
SPF, DKIM and DMARC — Explained in Detail
Email was invented without any built-in sender verification. Any server can send a message with any sender address — including info@your-company.ch. The three methods close this gap. SPF (Sender Policy Framework) is a list of the servers allowed to send mail for a domain. DKIM (DomainKeys Identified Mail) adds a digital signature to every message, which the recipient checks against a public key in the DNS. DMARC defines what should happen to messages that fail both checks, and provides reports about them.
For SMEs the topic usually becomes visible when emails fail to arrive. Typical cases: the website's contact form sends confirmations through a service that is not listed in the SPF record. The newsletter provider does not sign with the company's own domain. After switching email provider, the old SPF record was never updated. The result is mail in spam folders or bounces that nobody notices.
Large mailbox providers have tightened the rules: since 2024 Google and Yahoo have required bulk senders to have valid SPF, DKIM and DMARC records. Even low-volume senders benefit, because correctly authenticated mail is delivered more reliably. On top of that comes protection of your own brand: with a strict DMARC policy, recipients reject forged mail sent in the company's name, such as fake invoices to customers.
Rollout happens step by step. First, SPF and DKIM are set up for all legitimate senders — email provider, website, newsletter, CRM, accounting. Then DMARC starts in monitoring mode (p=none) and delivers reports on which servers send in the domain's name. Only once all legitimate sources are cleanly authenticated is the policy tightened to quarantine or reject. If you outsource the maintenance of a website, clarify who looks after the DNS records for SPF, DKIM and DMARC; for existing domains this is a checkpoint in a website audit.
Example: enquiry confirmations in spam
An architecture practice notices that clients never receive the contact form's automatic confirmation. The website sends through a transactional email service that is missing from the SPF record and does not sign with the company domain. After adding it to SPF, setting up DKIM for the service and adding a DMARC record in monitoring mode, the confirmations arrive in the inbox. The DMARC reports also reveal an old newsletter service that is still sending in the domain's name.
When we build a new website, we set up form emails with correct authentication. The technical basics are covered in the entry on DNS.
Related Page
DNS (Domain Name System)Frequently Asked Questions About SPF, DKIM and DMARC
Yes. The records take little effort to set up, improve deliverability and protect the domain against forged senders. Small firms in particular are abused for fake invoice emails, precisely because they are rarely protected.
These are the DMARC policies. With none, messages are only monitored and reported; with quarantine, failing messages go to spam; with reject, they are refused. You start with none and tighten step by step.
Often because the service the website sends through is not listed in the SPF record or does not sign with your own domain via DKIM. A check of the DNS records shows this quickly.
More Terms Starting with "S"
Schema Markup
Schema Markup (Schema.org) is a semantic vocabulary for structuring website content. It helps Google...
SEO (Search Engine Optimization)
SEO (Search Engine Optimization) encompasses all measures to make a website more visible in the orga...
Server-Side Rendering (SSR)
Server-Side Rendering (SSR) means that HTML pages are generated on the server and sent fully rendere...
Ready for Your Project?
Apply this knowledge to your website — DLM Digital will help you.