SPF and DKIM Explained in Plain English
RedHub AI Editorialupdated August 18, 20265 min read
Jump to a section8
TL;DR
- What it is: SPF and DKIM are two DNS records that prove an email really came from you, not someone spoofing your domain.
- Who it's for: anyone setting up a sending domain, or checking one before turning on DMARC enforcement.
- How it works: SPF is a list of allowed servers. DKIM is a digital signature. DMARC needs at least one of them aligned with your domain to pass.
- Bottom line: get both right, or DMARC has nothing solid to check.
What are SPF and DKIM?
SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are DNS records that authenticate outgoing email. SPF is a published list of servers allowed to send mail for your domain, so a mailbox provider can check the sending server against it. DKIM adds a cryptographic signature to each message, so the receiving server can confirm the message wasn't altered and really came from a server holding your private signing key. Together, they give DMARC something real to check.
Best for: anyone about to publish a DMARC record, or unsure whether their current SPF and DKIM setup is actually correct — check both with the Email Deliverability & DMARC Enforcement Readiness Gate.
SPF and DKIM answer the same underlying question — "is this message really from who it says it's from?" — but they check it in different ways. Knowing what each one actually does, and where each one falls short on its own, is what makes the rest of email authentication make sense.
SPF: who's allowed to send as you
SPF is a single DNS TXT record listing the mail servers and services allowed to send email for your domain. When a message arrives, the receiving server checks the sending server's address against your published list. If it's not on the list, SPF fails.
The common trap: you need every service that sends mail as your domain — your email marketing platform, your CRM, your invoicing tool, your help desk — included in the same record. Miss one and its mail can start failing SPF. There's also a hard technical limit of 10 DNS lookups per SPF check, so a record with too many included services can break silently.
DKIM: proving the message wasn't tampered with
DKIM works differently. Instead of checking where a message came from, it checks whether the message content matches a digital signature attached when it was sent. Your sending platform holds a private key and signs each message; a matching public key published in your DNS lets the receiving server verify the signature. If the message changed in transit, or wasn't signed with the right key, DKIM fails.
| SPF | DKIM | |
|---|---|---|
| What it checks | Which servers may send for your domain | Whether the message matches what was signed |
| Where it lives | One DNS TXT record | A DNS TXT record per "selector" your sending tool assigns |
| Common failure | Forwarding rewrites the sending path and breaks it | The signature breaks if content is modified in transit |
| What it doesn't do alone | Doesn't stop spoofing of your visible "From" address | Doesn't verify the domain in the visible "From" address either |
Why you need both (and why neither is enough alone)
SPF breaks easily when a message gets forwarded, because the forwarding server isn't on your approved list. DKIM survives forwarding, since the signature travels with the message, but by itself it doesn't prove the domain in your visible "From" address is legitimate. DMARC needs at least one of the two to align with that visible domain — which is exactly why having both set up correctly gives you the safest foundation.
How to check your setup
- Look up your domain's SPF record and confirm every legitimate sending service is included.
- Confirm a DKIM selector record exists for each platform you send from — most email platforms show you the exact record to publish in their setup guide.
- Send yourself a test message and check the authentication results header, or run a full grade with a readiness tool that checks SPF, DKIM, and DMARC alignment together.
SPF and DKIM are necessary, not sufficient by themselves. Getting both right is the foundation. DMARC is what actually enforces anything on top of them — see DMARC explained for the enforcement side.
This isn't just about newsletters. A Speed-to-Lead Routing Kit reply needs to land the moment a lead comes in, and a Lead-to-Meeting Engine sequence depends on every touch actually reaching the inbox. Broken SPF or DKIM on the sending domain undercuts both.
Check your SPF and DKIM setup in minutes
The Email Deliverability & DMARC Enforcement Readiness Gate grades SPF, DKIM, DMARC, alignment, one-click unsubscribe, and complaint headroom — ENFORCING, AT RISK, or FAILING, per domain.
Get the Readiness Gate — $79 →SPF and DKIM are the foundation for DMARC and for the wider deliverability picture — see email deliverability, explained.
Decision Guide
Fix this first if: you haven't published SPF and DKIM correctly for every sending service, or you've never checked.
Move on if: both are confirmed correct and passing — your next step is setting up DMARC enforcement.
Best first step: pull up your domain's SPF record and list every service that should be in it. Missing entries are the most common cause of failure.
Common Questions
What is SPF?
SPF is a DNS record listing which mail servers are allowed to send email for your domain. Receiving servers check the sending server against this list.
What is DKIM?
DKIM is a digital signature attached to outgoing email. The receiving server checks it against a public key in your DNS to confirm the message wasn't altered.
Do I need both SPF and DKIM?
Yes. Each one covers a gap the other has. SPF breaks on forwarding; DKIM doesn't verify the visible sending domain by itself. Together, they give DMARC something reliable to check.
Why does forwarding break SPF?
SPF checks the actual sending server's address. When a message is forwarded, the forwarding server — not your original approved sender — is what the receiving server sees, so the check fails.
How do I check my SPF and DKIM setup?
Look up your domain's SPF TXT record and confirm every sending service is listed. Confirm your DKIM selector record matches what your email platform's setup guide specifies. A readiness tool can check both plus alignment at once.
Does having SPF and DKIM replace DMARC?
No. SPF and DKIM authenticate a message. DMARC is the separate record that decides what happens when either one fails, and reports the results back to you.
The gate this post refers to, drawn from the tool’s own logic. See the tool.