SPF, DKIM en DMARC uitgelegd: wat doen ze voor je e-mail?

You send a quote, the customer sees nothing and after two days the email turns out to be in spam. Or worse: someone else sends email that looks like it comes from you. Usually this comes down to three small texts in the DNS of your domain: SPF, DKIM and DMARC.

In this SPF, DKIM and DMARC explanation you read what each record does, how they work together and how to check for yourself that they are correct. Without jargon where possible, and with examples you can recognise.

You don't need to be a technical person. A bit of patience and fifteen minutes is enough.

What SPF, DKIM and DMARC do together

Email is old and has one weakness: anyone can enter info@jouwbedrijf.nl as the sender. There is no lock on the sender line. A receiving mail server (Gmail, Outlook, you name it) has to decide for itself whether a message really comes from you.

The three records help with that. A comparison with a letter on paper:

• SPF is the list of postal workers who may deliver letters in your name.
• DKIM is the seal on the envelope. It shows that the contents were not changed along the way and that the seal is yours.
• DMARC is your instruction to the recipient: what should happen to a letter that fails the check, and send me a report.

All three are stored as a text record (usually TXT) in the DNS of your domain. You don't see them in your email program, but receiving servers read them for every message.

SPF: which servers may send email on behalf of your domain

SPF stands for Sender Policy Framework. The record is a list of servers or services that may send from your domain. If a message comes from a server that is not on the list, that is suspicious.

An example for a domain that uses Google Workspace:

v=spf1 include:_spf.google.com ~all

This is how you read it: v=spf1 says that it is an SPF record. include:_spf.google.com means that Google's servers may send. ~all means: everything not listed is suspicious, but don't reject it right away. With -all you say it more strictly: reject the rest.

Where SPF often goes wrong

• Two SPF records. A domain may have only one. If you add a newsletter service, add an include: to the existing record instead of creating a second one.
• Too many services. SPF allows only a limited number of DNS lookups (ten). Anyone who crams their accounting software, web shop, newsletter and CRM into it quickly goes over that limit.
• Forwarding. If someone automatically forwards your email, the message comes from another server and SPF fails. That is why SPF alone is not enough.

DKIM: a signature that shows the email is genuine

DKIM works with a key pair. Your mail server puts a digital signature on every outgoing message, made with a secret key that only it knows. Your DNS holds the matching public key. The recipient retrieves it and checks whether the signature is correct.

If it is correct, the recipient knows two things: the message really comes through the service your domain uses, and nothing was changed along the way. That last point is the big advantage over SPF. DKIM usually survives forwarding.

A DKIM record looks something like this:

selector1._domainkey.jouwbedrijf.nl TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

The first part (selector1) is called the selector. Each mail service uses its own name, so you can have several services sign side by side. The long part after p= is the public key. You never copy it from memory. You get it from your mail provider and paste it exactly as it is.

Note: for some services, DKIM is not turned on automatically. With Google Workspace, you create the key in the admin console and still need to enable signing. With Microsoft 365 you use two CNAME records. A step-by-step guide is in our article on setting up DMARC for Microsoft 365 and Google.

DMARC: what should happen when the check fails

SPF and DKIM only give a result. DMARC decides what recipients do with it. The record is always located at _dmarc.jouwbedrijf.nl and does three things:

1. It requires that SPF or DKIM not only passes, but also matches the domain shown in the sender line. This is called alignment. That way a scammer cannot pass with their own domain while showing your name.
2. It sets a policy: do nothing, send to spam or reject.
3. It asks for reports, so you can see who is sending mail in your name.

A starter record:

v=DMARC1; p=none; rua=mailto:dmarc@jouwbedrijf.nl

With p=none nothing changes in how mail is handled. You only collect reports. After that you can scale up:

The reports (rua) arrive as XML files. They are not made for human eyes. For a small business with one or two mail streams, that is usually not a problem: start with p=none, check whether your own mail passes and scale up after that. If you have many services that send mail in your name, have someone who does this more often read the reports.

How to check that your domain is set up correctly

You do not need to install anything here. Do this in order:

1. Run the website check. The free website check looks at, among other things, the email settings of your domain, such as SPF and DMARC. You see right away whether a record is missing or built incorrectly.
2. Count your SPF records. There must be exactly one. None, or two, is an error.
3. Check that all your services are listed. Think of your mail provider, newsletter service, web shop, invoicing software and CRM. Everything that sends mail in your name belongs in SPF and preferably in DKIM too.
4. Send a test mail to yourself. Open the message at a different email address (for example a personal Gmail) and view the full message header (headers). Search for spf=pass, dkim=pass and dmarc=pass. If it says pass everywhere, it works.
5. Also test mail from your other services. Send an invoice or an order confirmation. That is often where it goes wrong, because that service was never added.

DNS changes are not always visible right away. It can take a few hours before everything is updated everywhere, so after a change, do not test three times in a row straight away.

Common mistakes and how to avoid them

• Setting it to p=reject right away. If you then forget one service, for example your accounting software, those emails are rejected. Start with none.
• DMARC without SPF or DKIM. DMARC looks at the result of those two. Without those records, everything fails.
• Leaving an old mail provider in place. A moved domain that still has an old include: in SPF is a hole in your list. Remove what you no longer use.
• Typos in the key. One missed letter in the DKIM key and the signature never matches. Copy and paste the whole record.
• Thinking it is done. If you start using a new service that sends mail, the record must be updated.

Even with everything in order, a message can end up in spam, for example because of the content or a poor sender reputation. The three records are the basis, not a guarantee. Without that basis, the risk of problems is much higher. A well-configured sender also makes it harder for scammers to abuse your name. You can read how to recognise such a fake email yourself in recognising phishing: 7 signs in an email that does not add up.

What to do now

Start with the result of the free website check for your domain. If you are missing SPF or DMARC, you know where to begin. Then make a list of everything that sends mail in your name and add those services to your SPF record. Turn on DKIM for every service that supports it and start DMARC at p=none. After a few weeks, check whether everything passes, and then tighten the policy.

Do not want to work this out yourself? With Netslim business email mailboxes, MX, SPF, DKIM and DMARC are set up correctly automatically. If you use Google Workspace, you can read how the DNS fits in Google Workspace Netherlands: licences, price and DNS. You change the DNS records of your domain yourself in the Netslim portal. If you cannot work it out, you can reach us via the contact page.

Frequently asked questions

Do I need all three records, or is SPF enough?

SPF alone is not enough. It fails, for example, as soon as mail is forwarded. With DKIM added, your message has a signature, and DMARC makes sure receivers know what to do with failed checks. Large mail providers expect all three to be set up correctly together.

Why does my email end up in spam when SPF and DKIM are correct?

Then other things are involved: the reputation of your domain or server, the content of the message, or many people marking your email as spam. The records only prove that you are the sender, not that your email is wanted. Also check that your recipient list is correct and that you don't use suspicious links or attachments.

Can I set DMARC to reject without anything going wrong?

Only if you are sure that all your mail streams pass SPF or DKIM with your domain. So start with p=none, look at the reports for a few weeks and then switch to quarantine. Only after that is reject a sensible choice.

How long does it take for a new SPF, DKIM or DMARC record to work?

That depends on the DNS cache time. A change is often visible within an hour, but sometimes it takes a few hours. So don't test right after saving, but give it some time.