Someone told you your domain needs SPF, DKIM, and DMARC. What do the three records decide?
It might have been an insurance application, a customer’s questionnaire, or your IT person. Your email works, replies go out, and mostly that is handled.
Sending mail and being believed are separate. A system that receives a message with your domain on it has to decide whether you sent it, and three records in your domain’s DNS are what it checks.
What each record does
A message passes DMARC if the SPF check or the DKIM check passes with matching domains. It fails only if both fail.
- SPF lists the sources allowed to send mail for your domain.
- DKIM adds a digital signature to important parts of each message, including the From address, so the receiver can tell it wasn’t altered on the way.
- DMARC uses the SPF and DKIM results to check that the domain in the hidden envelope sender and the domain in the visible From address line up. It also tells receivers what to do with a failure and where to send reports.
The part that matters most: the DMARC policy
A domain with a DMARC record set to none has a record, and forged mail that claims the domain is still delivered. Microsoft also notes that what actually happens depends on the receiving system, so a policy is a request, not a guarantee.
- p=none: no suggested action for a failing message. Google says it delivers the message as normal and logs it in a report. This value is for testing and monitoring.
- p=quarantine: the message should be accepted but marked, for example sent to the junk folder.
- p=reject: the message should be refused.
Look at your own records
- DMARC. The record is a TXT record at _dmarc.yourdomain.com. On a Windows computer, open Command Prompt and run: nslookup -type=TXT _dmarc.yourdomain.com. Read the value after p=.
- SPF. Run: nslookup -type=TXT yourdomain.com. Find the single TXT record that begins v=spf1. A domain should have one. Microsoft notes SPF records that need more than 10 DNS lookups produce errors.
- DKIM. Signing has to be configured for each domain you send from. In Microsoft 365, signing with your own domain has to be set up for that domain; it does not happen on its own.
- A real message. Open the header of a message you received from your own domain and find Authentication-Results. You want spf=pass, dkim=pass, and dmarc=pass. A result of dmarc=bestguesspass means the domain has no DMARC record published.
The senders people forget
Newsletter tools, invoicing systems, and website contact forms often send mail with your domain on it. Unless each signs with your domain or uses your domain as its envelope sender, it passes its own checks and still fails DMARC. Microsoft’s example: SPF passes for the service’s domain, DKIM passes for the service’s domain, and DMARC fails because neither matches the From domain.
That is the reason both Microsoft and Google advise moving in steps: start at none, read the reports sent to the address in rua=, add each legitimate sender, then move to quarantine and reject. Microsoft also says to use a subdomain, such as marketing.yourdomain.com, for services you don’t control, and to set domains you own but don’t use for mail to p=reject. A DMARC record on the main domain covers its subdomains unless a subdomain has its own.
The reports sent to the rua= address arrive as compressed XML files, roughly daily, listing the IP addresses sending mail with your domain and whether each passed. Microsoft suggests a dedicated mailbox or group for them instead of one person’s inbox, and notes the volume can be large enough that a reporting service helps read them. An unfamiliar IP address with a high message count is a sender to identify.
What these records do not do
- They don’t stop a look-alike domain, because that is a different domain with its own records.
- They don’t stop mail sent by someone who is signed in to your real mailbox. That mail is genuinely from you, and it passes.
- They do not remove forged mail from other people’s inboxes. They give receivers a basis for treating it as forged.
What we check with you
The three records as they stand today, the header of a sample message, and a list of every service that sends mail as you. You get the records as we read them, with the date.
The policy in your DMARC record is the setting that decides whether a forged message is treated as mail from you or as a forgery.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.