SPF, DKIM and DMARC explained without the jargon
Three DNS records decide whether your emails reach the inbox or land in spam. Here is what each one does and how to set them up.
You send an important email and it lands in the recipient’s spam folder - or never arrives at all. Nine times out of ten the cause is not the content, but missing email authentication. Three DNS records fix it: SPF, DKIM and DMARC. Here is what each does, in plain terms.
SPF - who is allowed to send
SPF (Sender Policy Framework) is a list of servers permitted to send email for your domain. The receiving server looks it up and asks: “Did this message come from an approved server?” If not, it is treated as suspicious.
It is a single TXT record, for example:
v=spf1 include:_spf.hostzone.eu -allThe -all at the end means “anything not on the list should be rejected”.
DKIM - a signature that proves it
SPF says the server is allowed. DKIM (DomainKeys Identified Mail) proves the message was not tampered with on the way. Your server signs each email with a private key; the matching public key sits in your DNS. The receiver checks the signature - if it holds, the message is genuine and unchanged.
DKIM is what stops someone from copying an approved server and forging your mail.
DMARC - the policy that ties them together
SPF and DKIM each answer one question. DMARC (Domain-based Message Authentication) decides what to do when a message fails them, and asks receivers to report back.
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdom.eup=none- only monitor and collect reports (start here)p=quarantine- send failing mail to spamp=reject- refuse it outright (the strongest setting)
The reports (rua=) show you who is sending as your domain, so you can spot both misconfigurations and impersonation attempts.
Quick checklist
- Publish an SPF record listing your mail servers.
- Enable DKIM and add the public key to DNS.
- Start DMARC at
p=none, read the reports, then tighten toquarantineorreject.
Set all three and your legitimate mail earns trust, while anyone forging your domain gets stopped.
Every HOSTZONE email plan ships with SPF and DKIM ready to go, and we are glad to help you dial in DMARC. Just write to support@hostzone.eu.