# Authentication: SPF, DKIM, and DMARC

> SPF authorizes sending hosts, DKIM signs message content, and DMARC tells receivers what to do on failure while giving you aggregate reports. Ship all three before you scale volume. Alignment matters as much as record existence.

- **Course:** Deliverability fundamentals
- **Canonical:** https://emailmarketing.sh/lessons/authentication-spf-dkim-dmarc
- **Updated:** 2026-05-28

## Objectives

- Publish correct SPF and DKIM for your ESP
- Move DMARC from none to quarantine or reject with monitoring
- Explain identifier alignment in plain language

## SPF: who may send for this domain

SPF is a DNS TXT record listing authorized sending IPs or includes. Keep it short. SPF has a ten-DNS-lookup limit. Too many vendors in one record breaks authentication silently.

```text
v=spf1 include:send.example-esp.com include:_spf.google.com -all
```

## DKIM: cryptographic integrity

Your ESP signs messages with a private key. Receivers fetch the public key from a selector DNS record. Protect the private key by never hosting it yourself unless you operate your own signing infrastructure.

## DMARC: policy and feedback

DMARC ties SPF and DKIM to the domain users see. Aggregate reports show who is sending as you. That includes legitimate ESPs you forgot and spoofers you need to reject.

**Mailbox provider baselines:** Gmail and Yahoo published stricter bulk-sender requirements in 2024, including authentication and easy unsubscribe for commercial mail. Treat those as the floor, not optional polish.

## Checklist

- SPF includes only current sending services
- DKIM keys rotated and 2048-bit where supported
- DMARC rua mailbox monitored weekly
- No leftover SPF includes from abandoned tools

## FAQ

### What DMARC policy should I start with?

Start with p=none to collect data, fix alignment issues, then move to quarantine and reject. Skipping monitoring is how teams lock out a forgotten ESP.

---

Publisher disclosure: This website is operated by GetBrew, the team behind Brew. Coverage is based on public product documentation. Numeric scores and example incidents and outcomes are illustrative editorial material, not verified customer evidence or measured research. Verify current capabilities and limits with each vendor.