SPF, DKIM and DMARC, explained

Four kinds of DNS record decide whether your domain's email arrives: MX says where mail for the domain is delivered, SPF which servers may send it, DKIM signs every message, and DMARC tells receivers what to do with mail that fails. Here is what each does and what to add.

Get startedRead the docs

Updated

What each record does

RecordWhereWhat it does
MXThe domain itselfNames the servers that receive mail for the domain, with a priority. Without it nothing arrives.
SPFTXT on the domainLists the servers allowed to send as the domain. Receivers compare the sending server with this list.
DKIMTXT on selector._domainkeyPublishes a public key. The sending server signs each message with the private key; receivers check the signature.
DMARCTXT on _dmarcPolicy for mail that fails SPF and DKIM alignment (none, quarantine or reject) and an address for reports.

The records Mektup gives you

When you add a domain, Mektup generates a DKIM key for it and shows exactly these five records:

yourdomain.com.                 MX   10 mail.usemektup.com.
yourdomain.com.                 TXT  "v=spf1 include:spf.usemektup.com ~all"
mail._domainkey.yourdomain.com. TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"
_dmarc.yourdomain.com.          TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@usemektup.com"

The SPF and DKIM values are specific to Mektup and your domain; copy them from the dashboard or GET /v1/domains/:domain/records. Mektup never changes your DNS; you add the records where your domain's DNS is managed.

If you already send from the domain

Keep one SPF record and put every service in it. For example, if Google Workspace also sends for the domain:

# one SPF record per domain: put every sender in the same record
v=spf1 include:_spf.google.com include:spf.usemektup.com ~all

DKIM needs no merging: each service has its own selector, and Mektup's is mail. Keep a single DMARC record.

Check that it works

  1. Press Verify in Mektup (it checks the MX records), or call POST /v1/domains/:domain/verify.
  2. Send a message to a Gmail address, open it, choose "Show original" and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
  3. Watch the DMARC reports for a few weeks, then tighten the policy.

Questions

What is the difference between SPF, DKIM and DMARC?

SPF lists which servers may send mail for your domain. DKIM adds a signature to each message that receivers check against a public key in your DNS. DMARC tells receivers what to do when a message fails both, and where to send reports.

Do I need all three?

Yes. Gmail and Yahoo require SPF or DKIM from every sender and SPF, DKIM and DMARC from anyone sending in bulk; without them your mail goes to spam or is refused.

Can I have two SPF records?

No. A domain must have exactly one SPF record. If you already send with another service, add Mektup's part to your existing record instead of creating a second one.

Should my DMARC policy be none, quarantine or reject?

Mektup's records start at p=quarantine: mail that fails both SPF and DKIM alignment goes to spam instead of the inbox it pretends to come from. When the reports show that all your real mail passes, move to reject to stop others from spoofing your domain.

How long does DNS take?

Usually minutes, sometimes a few hours, depending on your DNS host and the record's TTL. In Mektup, check with Verify (or POST /v1/domains/:domain/verify) once the records are added.

Get startedorGet a quote

Starter is $20 a month. Agencies get a quote for every client domain on one account.