Email DNS records: SPF, DKIM and DMARC

Updated 7/20/2026

If you send email from your domain (from an app or your own server), three DNS records decide whether you reach the inbox or spam: SPF, DKIM and DMARC.

SPF: who is allowed to send

A TXT record that lists the servers authorized to send email for the domain:

example.com.  TXT  "v=spf1 ip4:203.0.113.10 -all"

DKIM: a cryptographic signature

The email server signs each message, and the public key is published in DNS:

selector._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=PUBLIC_KEY"

DMARC: what happens to messages that fail

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Do not forget reverse DNS

Besides these three, you need a correct PTR for the server IP, see What is reverse DNS (PTR).

Verify

Send a test email to a Gmail account and check in the message details whether SPF, DKIM and DMARC show as "PASS". There are also free online tools to test these records.

Put this guide into practice on your own VPS

EU cloud servers, billed hourly, ready in minutes, with one-click installs for dozens of apps.

See pricing

What is a CDN and when you need one

A CDN delivers content close to visitors, faster. Here is how it works and when it is worth it.

Updated 7/20/2026 Networking & DNS

How to connect two servers over a private network

Link your servers through an encrypted WireGuard tunnel, so they communicate securely without exposing services to the internet.