Bengaluru and Erode, India — working with clients in other time zones

Email Marketing Tools

SPF, DKIM and DMARC setup explained without the jargon

A clear, jargon-free explanation of SPF, DKIM and DMARC email authentication protocols, and practical guidance for setting them up correctly.

A laptop on a desk beside envelopes and email marketing notes

SPF, DKIM and DMARC are the three core email authentication protocols underlying modern deliverability requirements, and understanding what each genuinely does makes setup considerably less intimidating.

What each protocol genuinely does

  • SPF (Sender Policy Framework): specifies which mail servers are authorised to send email on behalf of your domain.
  • DKIM (DomainKeys Identified Mail): adds a cryptographic signature verifying an email genuinely came from your domain and was not altered in transit.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance): tells receiving mail servers what to do if SPF or DKIM checks fail, and provides reporting on authentication failures.

Think of SPF as a guest list, DKIM as a tamper-proof seal, and DMARC as the instructions for what to do if someone shows up who is not on the list or the seal looks broken — together they form one coherent authentication system, not three unrelated checkboxes.

Practical setup guidance

  • Add the SPF record provided by your email sending provider to your domain's DNS settings.
  • Enable DKIM signing through your email provider and add the corresponding DNS record.
  • Configure a DMARC policy, starting with a monitoring-only mode before moving to stricter enforcement.

Frequently asked questions

Who should set up these DNS records?

Whoever manages your domain's DNS settings, working from the specific records your email marketing provider generates for your account.

Is it safe to start DMARC in monitoring-only mode?

Yes, this is a genuinely recommended approach, allowing you to review authentication reports before moving to a stricter enforcement policy that could reject legitimate email if misconfigured.

How long does it take for these DNS changes to take effect?

DNS propagation typically takes anywhere from a few minutes to 48 hours, depending on your domain provider and existing DNS record settings.

If you want help setting up proper email authentication for your domain, talk to our team.

The takeaway

Set up all three protocols together (SPF, DKIM and DMARC) rather than just one — they work as a complementary system, and implementing only one leaves genuine authentication gaps the others are specifically designed to close.


Written by Fibvo — Bengaluru and Erode, India — working with clients in other time zones. Questions, or think we have it wrong? Tell us.

Keep reading

Related articles

Next step

Tell us what you are trying to grow.

Send the problem in a paragraph. We will reply within one working day with an honest view of whether we can help, and what it is likely to cost.

Call +91 93451 90983 WhatsApp us