Blog/
SPF and DMARC explained: protect your domain from spoofing
A practical guide to SPF and DMARC DNS records — what they do, how to check them, and why they improve deliverability.
Email authentication tells receiving servers which hosts are allowed to send mail for your domain, and what to do when a message fails those checks. The two DNS records most teams start with are SPF and DMARC.
What SPF does
SPF (Sender Policy Framework) is a TXT record that lists authorized senders — your mail host, ESP, or include: mechanisms. When a message arrives, the receiver checks whether the connecting IP is allowed by that policy.
What DMARC does
DMARC builds on SPF and DKIM. It tells receivers how to handle failures (none, quarantine, or reject) and where to send aggregate reports. Without DMARC, spoofed From: addresses are easier to abuse.
- p=none — monitor only; good for rollout.
- p=quarantine — treat failures as spam.
- p=reject — block failing messages at the edge.
Free DNS check for SPF, DMARC, MX, MTA-STS, and BIMI.
Common mistakes
- Multiple SPF TXT records on the same name (invalid — merge into one).
- Too many DNS lookups in SPF (10-lookup limit).
- DMARC with rua= missing — you never see failure reports.
- Forgetting to authorize a new ESP after switching providers.
After you publish or change records, wait for DNS TTL and verify with a propagation checker so public resolvers agree.