All three live in DNS as TXT records. SPF lists the servers allowed to send for a domain, DKIM publishes the public key that checks message signatures, and DMARC says what receivers should do when neither passes in alignment with the visible From: domain. The background is in How Email Authentication Works: SPF, DKIM and DMARC; the tables below follow RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 with its May 2026 successor RFC 9989 (DMARC). Examples use example.com and documentation addresses.
Where each record lives
| Record | DNS name | Example value |
|---|---|---|
| SPF | the domain itself: example.com |
v=spf1 mx include:_spf.example.net -all |
| DKIM key | <selector>._domainkey.example.com |
v=DKIM1; k=rsa; p=MIIBIjANBgkq... |
| DMARC | _dmarc.example.com |
v=DMARC1; p=quarantine; rua=mailto:[email protected] |
SPF mechanisms (RFC 7208)
| Mechanism | Matches when the sending IP... | DNS lookup? | Example |
|---|---|---|---|
ip4 |
is in the IPv4 address or range | No | ip4:192.0.2.0/24 |
ip6 |
is in the IPv6 address or range | No | ip6:2001:db8::/32 |
a |
is an A/AAAA address of the domain (or the named one) | Yes | a, a:mail.example.com |
mx |
is an address of one of the domain's MX hosts | Yes | mx, mx:example.net |
include |
passes the SPF record of another domain | Yes | include:_spf.example.net |
exists |
makes the given (macro-expanded) name resolve to any A record | Yes | exists:%{i}._spf.example.com |
ptr |
reverse-resolves to the domain (slow; the RFC says do not use) | Yes | ptr |
all |
always matches; goes last | No | -all |
| Modifier | Meaning | Example |
|---|---|---|
redirect= |
Use another domain's SPF record when nothing else matched | redirect=_spf.example.com |
exp= |
Name of a TXT record holding a rejection explanation | exp=explain._spf.example.com |
SPF qualifiers and results
| Qualifier | Result | Meaning |
|---|---|---|
+ (default) |
pass |
Authorised sender |
- |
fail |
Not authorised: reject |
~ |
softfail |
Probably not authorised: accept but mark |
? |
neutral |
No statement |
Other results: none (no SPF record), temperror (DNS timeout, retry later) and permerror (broken record, for example two v=spf1 records or too many lookups).
Limits: at most 10 mechanisms and modifiers that cause DNS lookups (include, a, mx, ptr, exists, redirect) per check, counting nested includes; ip4, ip6 and all are free. At most 2 lookups may return nothing ("void lookups"). The SPF Record Generator counts lookups for you.
Macros (used in exists and exp): %{s} sender, %{l} local part, %{o} sender domain, %{d} current domain, %{i} client IP, %{h} HELO name, %{v} in-addr or ip6, %{p} validated name of the IP (do not use).
DKIM-Signature header tags (RFC 6376)
| Tag | Required? | Meaning | Example |
|---|---|---|---|
v |
Required | Version | v=1 |
a |
Required | Algorithm | a=rsa-sha256 (also ed25519-sha256, RFC 8463) |
d |
Required | Signing domain (SDID) | d=example.com |
s |
Required | Selector; key is at s._domainkey.d |
s=mail2026 |
h |
Required | Signed header fields, colon-separated | h=from:to:subject:date |
bh |
Required | Hash of the canonicalised body (base64) | bh=47DEQpj8HBSa+/... |
b |
Required | The signature itself (base64) | b=dzdVyOfAKCdLXdJO... |
c |
Optional | Canonicalisation header/body; default simple/simple |
c=relaxed/relaxed |
i |
Optional | Agent or user identifier (AUID); default @d |
[email protected] |
l |
Optional | Body length signed (risky: allows appended content) | l=1024 |
q |
Optional | Key query method; default dns/txt |
q=dns/txt |
t |
Recommended | Signing time, Unix seconds | t=1791600000 |
x |
Recommended | Expiry time, Unix seconds, must be after t |
x=1792204800 |
z |
Optional | Copied header fields, for diagnostics | z=From:... |
RFC 8301 retired rsa-sha1: signers must not use it, and RSA keys must be at least 1024 bits (2048 recommended).
DKIM key record tags (RFC 6376)
| Tag | Required? | Meaning | Example |
|---|---|---|---|
v |
Recommended | Version; must come first if present | v=DKIM1 |
k |
Optional | Key type; default rsa |
k=ed25519 |
p |
Required | Public key (base64); empty means the key is revoked | p=MIIBIjANBgkq... |
h |
Optional | Hash algorithms accepted; default all | h=sha256 |
s |
Optional | Service type; default * |
s=email |
t |
Optional | Flags: y testing, s strict (i= domain must equal d=) |
t=s |
n |
Optional | Notes for humans | n=rotated 2026-10 |
A TXT string holds at most 255 characters, so a 2048-bit key is published as several quoted strings in one record, which resolvers join. Generate keys and the record with the DKIM Record Generator.
DMARC tags
| Tag | Meaning | Values and default | RFC 7489 | RFC 9989 |
|---|---|---|---|---|
v |
Version, must be first | DMARC1 |
Required | Required |
p |
Policy for the domain | none, quarantine, reject |
Required | Recommended (missing = none) |
sp |
Policy for subdomains | same values; default p |
Yes | Yes |
np |
Policy for non-existent subdomains | same values; default sp, then p |
(RFC 9091) | Yes |
adkim |
DKIM alignment | r relaxed (default), s strict |
Yes | Yes |
aspf |
SPF alignment | r relaxed (default), s strict |
Yes | Yes |
rua |
Aggregate report addresses | mailto: URIs, comma-separated |
Yes | Yes |
ruf |
Failure report addresses | mailto: URIs |
Yes | Yes |
fo |
When to send failure reports | 0 (default), 1, d, s, colon-separated |
Yes | Yes |
pct |
Percentage of failing mail the policy applies to | 0 to 100, default 100 |
Yes | Removed |
t |
Test mode: apply one level below p |
y, n (default) |
No | Yes |
psd |
Marks a public suffix domain | y, n, u (default) |
No | Yes |
rf |
Failure report format | afrf (default) |
Yes | Removed |
ri |
Aggregate report interval in seconds | 86400 (default) |
Yes | Removed |
Receivers still meet both generations; pct=100 and t=n are both the default behaviour, so a record without either is read the same way everywhere.
Example records
| Purpose | Record |
|---|---|
| Domain that sends no mail at all | SPF v=spf1 -all, DMARC v=DMARC1; p=reject; sp=reject |
| Own servers plus one provider | v=spf1 mx ip4:192.0.2.25 include:_spf.example.net -all |
| First DMARC step: monitor | v=DMARC1; p=none; rua=mailto:[email protected] |
| Enforce strictly, report daily | v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:[email protected] |
| Ed25519 DKIM key | v=DKIM1; k=ed25519; p=<32-byte key in base64> |
Check what a domain publishes with the DNS Record Lookup or the Email Deliverability Checker, and see how a received message fared in its Authentication-Results header with the Email Header & Security Analyzer.