[ BLOG POST ]
What SPF, DKIM and DMARC do, and why your domain needs all three
SPF, DKIM and DMARC are DNS records that tell inbox providers which servers may send for your domain and whether the mail is authentic.
Quick answer
SPF, DKIM and DMARC are DNS records that tell inbox providers which servers can send mail for your domain, whether each message is signed, and what to do when checks fail. A domain that publishes all three is far easier for receivers to trust.
Key takeaways
SPF lists the servers allowed to send mail for your domain.
DKIM signs each message so receivers can confirm it was not altered.
DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports.
What does each record do?
SPF lists the servers allowed to send mail for your domain. DKIM attaches a cryptographic signature to each message, so receivers can confirm that the message was not altered and was signed with a key you control. DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports.
Each record does something different, so a domain with only one of them is still exposed. Missing records are one of the most common reasons legitimate mail lands in spam.
Where do the records go?
When you add a sending domain in Sendflit, the dashboard shows the DNS records to publish. DKIM goes on a selector record under sendflit._domainkey for your domain, SPF goes on the domain itself, and DMARC goes on _dmarc for the domain.
Publish them exactly as shown, then verify the domain. Sendflit refuses to send from an unverified domain and returns a 403 response.
What are common SPF mistakes?
SPF allows a limited number of DNS lookups, and every extra sending service uses some of them. Publishing a second SPF record, or a record with many includes, causes failures that look random.
Keep one SPF record per domain, and merge the includes you need into it. Rotate DKIM keys by publishing the new selector before retiring the old one.
Frequently asked questions
What is the difference between SPF and DKIM?
SPF checks that the sending server is allowed to send for your domain. DKIM checks a cryptographic signature on the message itself, so it still works when mail is forwarded.
Do I need all three records?
For bulk and business mail, yes. Inbox providers increasingly expect SPF, DKIM and DMARC together.
Why is my domain not verified?
Usually the DNS records have not finished propagating, or one of them was published with a typo. Compare the published records with the ones the dashboard shows.
Last updated October 2026 by the Sendflit team.