SPF, DKIM and DMARC, explained in plain English
Three short DNS records decide whether Gmail and Outlook believe your email is really from you. Without them, genuine mail lands in spam and anyone can forge your address. Here is what each one does, what it looks like, and how to get them right.
Updated 26 October 2026.
Why receivers check them
Email was designed without any proof of who sent a message: anyone can write any address in the “From” line. Spammers and fraudsters use that to send mail that looks like it comes from your business — fake invoices, changed bank details, password-reset tricks. To protect their users, Gmail, Outlook, Yahoo and every serious mail service check three records that only the owner of a domain can publish:
- SPF — which servers may send mail for your domain.
- DKIM — a signature on every message that proves it came from your domain and was not altered on the way.
- DMARC — what a receiver should do when a message fails those checks, and where to send reports about it.
Since 2024 Google and Yahoo have required SPF or DKIM from every sender, and all three from anyone sending more than 5,000 messages a day to their users. Mail that fails is more likely to be filtered or refused.
SPF: who may send for you
SPF (Sender Policy Framework) is one TXT record on your domain that lists the servers allowed to send its mail. A receiving server looks at where a message came from and checks that place against your list.
A typical SPF record for a business on GINbox:
v=spf1 include:_spf.ginbox.net ~all
v=spf1marks it as an SPF record.include:_spf.ginbox.netallows GINbox’s mail servers. Every other service that sends mail as your domain (a billing system, a newsletter tool, your website’s contact form) needs its own include.~allsays mail from anywhere else should be treated with suspicion.-allis stricter; use it once you are sure your list is complete.
DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) works like a wax seal. Your mail server signs each outgoing message with a private key that never leaves it. You publish the matching public key in DNS, under a name called a selector. The receiver fetches the key, checks the signature, and knows two things: the message really came from your domain, and nobody changed it on the way.
A DKIM record is a TXT record at a name like this, with a long key as its value:
selector._domainkey.yourcompany.in TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq…"
Your email provider creates the key pair and tells you the exact name and value. GINbox creates the keys for each domain, shows the records with copy buttons, and does not let a domain send until its DKIM record is published — so your mail is signed from the first message.
DMARC: the rule for fakes, and the reports
SPF and DKIM prove that a message is genuine, but neither says what to do with one that is not. DMARC (Domain-based Message Authentication, Reporting and Conformance) is that rule. It also checks alignment: the domain that passed SPF or DKIM must match the domain in the visible “From” address, so a fraudster cannot pass by using their own domain behind the scenes.
_dmarc.yourcompany.in TXT "v=DMARC1; p=none; rua=mailto:postmaster@yourcompany.in"
| Policy | What receivers do with mail that fails | When to use it |
|---|---|---|
| p=none | Deliver it as usual, and send you reports | The start: learn which services send as you |
| p=quarantine | Put it in spam | When reports show all your real mail passing |
| p=reject | Refuse it | The strongest protection against forged mail in your name |
The rua address receives daily summary reports from Gmail, Outlook and others: how much mail claimed to be from your domain, from where, and whether it passed. GINbox starts every domain at p=none with reports to your postmaster address, and keeps a DMARC record you already have.
How to check your records
- Send a message from your business address to a Gmail account you own.
- In Gmail, open it, choose ⋮ → Show original. The top of that page shows SPF, DKIM and DMARC, each with PASS or FAIL.
- Any FAIL: compare the record at your DNS host with what your provider asks for, letter by letter. A missing quote, an extra space or a second SPF record is the usual cause. In GINbox, the domain’s DNS tab shows each record as found or not found.
Still landing in spam with all three passing? Read why business email goes to spam — content, links and sending patterns matter too. And to see where these records fit among the others your domain needs, see what an MX record is.
Questions people ask
Do I need all three: SPF, DKIM and DMARC?
Yes. Gmail and Yahoo require SPF or DKIM from every sender and all three from anyone sending in bulk, and Outlook.com has similar rules. Even a small business benefits: mail that passes all three is far less likely to land in spam, and DMARC stops others from sending in your name.
Can a domain have two SPF records?
No. A domain must have exactly one SPF record. Two records make SPF fail for every message. If two services send for you, merge them into one record, for example v=spf1 include:_spf.ginbox.net include:other.example ~all.
What DMARC policy should I start with?
Start with p=none, which only asks for reports, and read the reports for a few weeks. When every service that sends for you passes, move to p=quarantine and then p=reject, which tell receivers to treat forged mail as spam or refuse it.
How long do the records take to work?
Usually minutes to an hour after you save them at your DNS host, sometimes longer because of caching. You can check them with any DNS lookup tool, and GINbox checks them for you in the admin panel.
Does GINbox set these up for me?
GINbox creates your DKIM keys, shows the exact SPF, DKIM and DMARC records for your domain with copy buttons, suggests one merged SPF record if you already have one, and checks every record until it is right. A domain cannot send until its DKIM record is published.
Try it on your own domain
Set up a real mailbox at your own domain, with every record checked for you. No card needed.