SPF, DKIM & DMARC Explained
The three DNS records that prove your email is genuinely yours, and what happens without them.
Email was designed without authentication: anyone can claim to be anyone. These three DNS records are how you prove otherwise. Since 2024, Gmail and Yahoo require them from bulk senders.
SPF: who may send
A list of servers authorised to send for your domain. A receiving server checks whether the sending machine is on your list.
v=spf1 include:_spf.google.com ~all
include:delegates to your provider's servers.~all= soft fail (accept but mark).-all= hard fail (reject).- You may publish only one SPF record. Two is a permanent error and SPF fails entirely.
DKIM: proof of authorship
Your provider signs each message with a private key. You publish the matching public key in DNS, so receivers can verify the message wasn't forged or altered.
The record lives at selector._domainkey.yourdomain.com. The selector is chosen by your provider. That's why Vecta can't always guess it and lets you type it in. Vecta tries the common ones for you, including google, selector1 (Microsoft), zoho and hostingermail1 (Hostinger).
DMARC: what to do on failure
Ties the other two together: it tells receivers what to do when checks fail, and sends you reports.
v=DMARC1; p=none; rua=mailto:you@yourdomain.com
| Policy | Effect | When to use |
|---|---|---|
| p=none | Monitor only; nothing rejected | Start here, read the reports |
| p=quarantine | Failures go to spam | Once reports look clean |
| p=reject | Failures rejected outright | Strongest protection |
Move gradually
Jumping straight to p=reject can silently kill legitimate mail from tools you forgot about. Start at p=none for a couple of weeks.
Checking your records
Vecta's Deliverability page performs live DNS lookups and flags the failure modes that matter, two SPF records, +all, a revoked DKIM key, or DMARC still at p=none. DNS changes can take up to 48 hours to propagate.
Did this help?
Related articles
Improving Deliverability
Practical habits that keep your campaigns out of spam: warm-up, list hygiene, content and cadence.
Hostinger SMTP Setup
Connect a Hostinger email account, including the correct host and port and the domain records to publish.
Before you send: spam check, test email and the final check
The tools that catch problems before your email leaves: the spam check, a test sent to yourself, the pre-send check, and the blocklist check.