SPF, DKIM and DMARC in plain words

SPF: who may send for this domain

SPF is a TXT record listing the servers allowed to send mail for your domain. A receiving server compares the sender with that list. A domain can have only one SPF record; if you use several services, they all go into that one record.

DKIM: a signature on every message

Your email provider signs each outgoing message with a private key. You publish the matching public key as a DNS record, so the receiver can check that the message was not changed and really came from a system you authorised. Each provider gives you its own DKIM record to add.

DMARC: what to do when the checks fail

DMARC ties the two together and tells receivers what to do with mail that fails: nothing (p=none, just report), put it in spam (p=quarantine) or refuse it (p=reject). It can also send you reports of who is sending mail as your domain.

• Start with p=none and a report address, so you can see what is being sent for you.
• Once the reports show only your own mail passing, move to quarantine, then reject.

How to check yours

Send a message to a Gmail address, open it, choose "Show original" and look for SPF, DKIM and DMARC. Each should say PASS. A FAIL or NONE tells you which record to look at first. Or run the free email checker on your domain.