Email Security

What SPF, DKIM and DMARC Actually Do for Your Domain's Email

Three separate DNS records, each answering a different question about whether an email claiming to be from your domain can be trusted — and what should happen when it can't.

DNS records working together: SPF, DKIM, DMARC

TXT

DNS record type used for all three

Cost to add SPF, DKIM and DMARC records via DNS

24/7

Human support for DNS and email authentication setup

In short

SPF, DKIM and DMARC are DNS records that work together to authenticate email and stop others from spoofing your domain. SPF lists which mail servers are allowed to send on your domain's behalf; DKIM adds a cryptographic signature to outgoing mail proving it wasn't altered in transit; DMARC tells receiving mail servers what to do (reject, quarantine, or allow) when a message fails SPF or DKIM, and where to send reports about it.

None of the three alone fully solves email spoofing — SPF can be bypassed by forwarding, DKIM alone doesn't say who's authorized to send — which is why the three are meant to be set up together, with DMARC tying the other two into an enforceable policy.

Email was never designed with strong sender verification built in, which is exactly why domain spoofing (an email claiming to be from you@yourbusiness.com that isn't) has stayed a persistent problem for decades. SPF, DKIM and DMARC are the industry's answer, added as DNS records rather than changes to email itself, and increasingly required rather than optional — major inbox providers now reject or heavily filter mail from domains without at least SPF and DKIM configured.

Each of the three records answers a genuinely different question, which is why they're described together but aren't interchangeable or redundant. Understanding what each one actually checks makes it clear why skipping any one of them leaves a real gap, and why DMARC specifically is the piece that turns the other two from passive checks into an enforced policy.

SPF: Who's Allowed to Send as Your Domain

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain — typically your hosting provider's mail servers, and any third-party service you use for sending, like a marketing platform or invoicing tool. When a receiving mail server gets a message claiming to be from yourdomain.com, it checks the sending server's IP address against your SPF record; if the IP isn't on the list, the message fails SPF.

The most common SPF misconfiguration is an incomplete record — adding a new sending service (like a CRM or a transactional email tool) without updating SPF to include it, which causes that service's genuinely legitimate mail to fail authentication. SPF also has a known limitation: it breaks when mail is forwarded through an intermediate server, since the forwarding server's IP, not your original one, is what the final recipient's server sees.

DKIM: Proving the Message Wasn't Altered

DKIM (DomainKeys Identified Mail) works differently from SPF — instead of checking which server sent the message, it adds a cryptographic signature to each outgoing email, generated using a private key your mail server holds. The corresponding public key is published in a DNS TXT record, and the receiving server uses it to verify the signature matches, confirming both that the message genuinely came from a server holding your private key and that its content wasn't altered in transit.

Unlike SPF, DKIM generally survives forwarding, since the signature travels with the message content itself rather than depending on which server relayed it last. This makes DKIM the more forwarding-resilient of the two, though it still doesn't say anything about whether the sending server was authorized in the first place — that's SPF's job, and it's why the two are meant to complement each other rather than substitute for one another.

DMARC: The Policy That Ties Them Together

DMARC (Domain-based Message Authentication, Reporting and Conformance) is also a DNS TXT record, and it does two things SPF and DKIM don't do on their own: it tells receiving mail servers exactly what action to take when a message fails SPF and/or DKIM (none, quarantine, or reject), and it requests aggregate reports showing who's sending mail using your domain, whether it passed authentication or not.

A DMARC policy set to 'none' only monitors and reports without blocking anything, which is the sensible starting point — it lets you review reports and confirm all your legitimate mail sources pass SPF or DKIM before tightening the policy. Moving to 'quarantine' (send failing mail to spam) and eventually 'reject' (block failing mail outright) is the recommended progression once you're confident nothing legitimate is failing, since jumping straight to reject risks blocking your own genuine mail if SPF or DKIM wasn't fully configured first.

Setting Up All Three Records

All three are added as DNS TXT records through your domain's DNS management, typically in your hosting panel or wherever your domain's nameservers point. Most cPanel-style hosting can generate a correct SPF and DKIM record automatically for its own mail servers when you set up email hosting, which covers the sending side; DMARC is usually added manually as a separate TXT record once SPF and DKIM are both confirmed working.

The order matters in practice: get SPF and DKIM passing consistently first, watch DMARC reports at a 'none' policy for a period to confirm nothing legitimate fails, then tighten to quarantine and finally reject. Skipping straight to a strict DMARC policy before SPF and DKIM are solid is the most common way this setup backfires, silently blocking a business's own outgoing mail.

Email Authentication Set Up Right, From the Start

SPF, DKIM and DMARC only work as intended when all three are configured correctly and in the right order — a partial setup can do more harm than none at all.

Hosting Cheap's cPanel-style panel generates SPF and DKIM records automatically for its mail servers, with 24/7 human support for adding and tightening a DMARC policy correctly.

SPF and DKIM records generated automatically for hosted mailboxes
DNS management for adding and adjusting a DMARC policy over time
Free auto-renewing SSL securing the panel used to manage DNS records
24/7 human support for authentication setup and deliverability questions

Why Hosting Cheap

What you get

Automatic SPF and DKIM for hosted mail

Mailboxes get correctly configured authentication records without manual setup for the hosting provider's own servers.

Full DNS management access

Add and adjust DMARC policy records as confidence in your authentication setup grows.

Free auto-renewing SSL

Keeps the panel session used to manage sensitive DNS records like SPF, DKIM and DMARC encrypted.

cPanel-style email tools

Manage mailboxes, forwarders and DNS-based authentication from one consistent panel.

Daily backups

DNS zone configuration has a recovery point if a record change needs reverting.

24/7 human support

Get help reviewing DMARC reports or troubleshooting a legitimate sender failing authentication.

How It Works

Get set up in a few steps

Confirm SPF and DKIM are set up and passing

Check that your hosting provider's SPF record includes all sending services and that DKIM signing is active.

Add a DMARC record at a monitoring-only policy

Set policy to 'none' first and review aggregate reports to confirm all legitimate mail passes authentication.

Tighten the DMARC policy gradually

Move to 'quarantine' then 'reject' only once reports confirm nothing legitimate is failing SPF or DKIM.

Included

Everything you need, on every plan

SPF record includes every service that sends mail on the domain's behalf
DKIM signing confirmed active for the hosting provider's mail servers
DMARC record added as a DNS TXT record with an initial 'none' policy
DMARC aggregate reports reviewed for a period before tightening policy
Any legitimate sending service failing SPF or DKIM identified and fixed
DMARC policy moved to 'quarantine' once reports look clean
DMARC policy moved to 'reject' only after quarantine shows no issues
DNS records rechecked after any change to hosting or email sending services

FAQ

Frequently asked questions

What is the difference between SPF, DKIM and DMARC?

SPF lists which servers are authorized to send mail for your domain, DKIM cryptographically signs outgoing mail to prove it wasn't altered, and DMARC tells receiving servers what to do when a message fails either check. They work together rather than doing the same job.

Do I need all three, or is one enough?

Each addresses a different gap, so using only one leaves a real weakness — SPF alone breaks under forwarding, DKIM alone doesn't confirm authorization, and neither enforces a policy without DMARC. Setting up all three, in the right order, gives the strongest protection against spoofing.

Why did legitimate email start failing after I added a DMARC policy?

This usually means SPF or DKIM wasn't fully passing for every legitimate sending service before the DMARC policy was tightened to quarantine or reject. Reviewing DMARC aggregate reports at a 'none' policy first catches this before it starts blocking real mail.

Does SPF stop all email spoofing on its own?

No, SPF only checks whether the sending server's IP is authorized, and it has a known weakness with forwarded mail, since the forwarding server's IP isn't the original sender's. DKIM and DMARC address gaps SPF leaves open on its own.

What DNS record type are SPF, DKIM and DMARC?

All three are added as TXT records in your domain's DNS zone, though DKIM's record is typically published under a selector-specific subdomain rather than the root domain. Most cPanel-style hosting panels manage these alongside other DNS records.

Is it safe to set DMARC straight to 'reject' immediately?

Not recommended — starting at 'reject' before confirming every legitimate sending service passes SPF or DKIM risks blocking your own real mail outright. Starting at 'none' to monitor, then moving to 'quarantine' and finally 'reject' once reports look clean is the safer, standard progression.

Ready for Email That Passes Authentication by Default?

Get mailboxes with SPF and DKIM configured automatically, plus 24/7 support for DMARC setup.

Get Started