Glossary
What are SPF, DKIM and DMARC?
Three email authentication standards that prove a message comes from your domain and tell receivers what to do if it doesn't.
Definition
SPF, DKIM and DMARC are three email authentication standards that prove a message really comes from the domain it claims. SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature, and DMARC tells receiving servers what to do when checks fail and sends you reports.
What each one does
- SPF (Sender Policy Framework). A DNS record listing which servers may send mail for your domain. Defined in RFC 7208, which allows only one SPF record per domain and caps evaluation at 10 DNS lookups; going over either returns an error.
- DKIM (DomainKeys Identified Mail). Your sending server signs each message with a private key, and receivers check it against a public key in your DNS. Defined in RFC 6376.
- DMARC. A DNS record that ties SPF and DKIM to the domain in the visible From address, sets a policy (none, quarantine or reject) and asks receivers to send reports. Now defined in RFC 9989, which replaced RFC 7489.
What Gmail and Yahoo require
Since February 2024, both providers ask all senders to use at least SPF or DKIM. Google defines bulk senders as those sending more than 5,000 messages a day to personal Gmail accounts; Yahoo has bulk-sender rules but doesn't publish a volume figure. Bulk senders to either must:
- Use both SPF and DKIM.
- Publish a DMARC policy, which can be p=none.
- Align the From domain with the SPF or DKIM domain.
- Keep spam complaints below 0.3% (Google recommends staying below 0.10%).
- Support one-click unsubscribe on marketing mail.
An example setup
Say your company sends from example.com through Google Workspace and a sales email tool. An illustrative setup: one SPF TXT record that includes both services, a DKIM key published for each service, and a DMARC record starting at p=none with a reporting address. After a few weeks of clean reports, you move to p=quarantine, then p=reject.
Common mistakes
- Adding a second SPF record for a new tool instead of editing the existing one.
- Stacking so many includes that SPF passes the 10-lookup limit.
- Leaving DMARC at p=none for years without reading the reports.
- Forgetting to set up DKIM in a tool that sends on your behalf.
Questions
Do I need SPF, DKIM and DMARC?
If you send business email, yes. Google and Yahoo require all senders to use at least SPF or DKIM, and bulk senders must use SPF, DKIM and a DMARC policy. Google defines bulk senders as those sending more than 5,000 messages a day to personal Gmail accounts.
What DMARC policy should I use?
Start with p=none so you receive reports without affecting delivery; Google and Yahoo accept p=none for bulk senders. Once reports show all your legitimate sending services pass, move to p=quarantine and then p=reject to stop others from spoofing your domain.
Can I have two SPF records?
No. RFC 7208, the SPF standard, says a domain with more than one SPF record produces a permanent error, so checks fail. If you add a new sending service, edit your single existing SPF record to include it instead of creating a second one.
Sources, checked 25 October 2026: Google: Email sender guidelines, Yahoo: Sender best practices, RFC 7208: Sender Policy Framework (SPF), RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC).
Less jargon, more conversations.
Siela AI finds people with a fresh reason to talk, reaches them on LinkedIn, X and email from your own accounts, and keeps your social going.