SPF, DKIM & DMARC explained

These three DNS-based standards prove that mail claiming to be from your domain is genuine. Together they stop attackers from spoofing your domain in phishing.

SPF (Sender Policy Framework)

A DNS TXT record listing which servers may send mail for your domain. Receivers reject or flag mail from servers not on the list. Strong records end with -all (hard fail) or ~all (soft fail).

v=spf1 include:_spf.google.com -all

When you use Spamless, add us to that record — we show the exact value on the domain's DNS panel: v=spf1 include:spamless.dev ~all.

DKIM (DomainKeys Identified Mail)

Adds a cryptographic signature to each message; the public key lives in DNS. The receiver verifies the signature to confirm the message wasn't altered and really came from your domain. Your mail provider generates the key and a "selector".

DMARC

Ties SPF and DKIM together and tells receivers what to do with mail that fails:

• p=none — monitor only (reports, no action),
• p=quarantine — send to spam,
• p=reject — refuse.

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Start at p=none to observe, then move to quarantine and finally reject. The Health page in your dashboard tells you whether a DMARC record exists for each of your domains and gives you a starter record to paste.

MTA-STS

Forces inbound mail to your domain over TLS, preventing downgrade attacks. It's a DNS record plus a policy file served over HTTPS.

Check yours for free

Not sure where your domain stands? Run our free checker — it grades your MX, SPF, DMARC and MTA-STS in seconds, no signup: spamless.dev/check. There's also a longer explainer at spamless.dev/guides/email-authentication.

Spamless also evaluates SPF/DKIM/DMARC on every inbound message as part of its filtering pipeline.