SPF DKIM DMARC Explained: A Simple Guide for 2026

SPF DKIM DMARC sounds like three pieces of jargon, and it is. But behind them sits a simple idea: when your website sends an email, the receiving server wants proof that it really came from you. These three records are that proof.

This guide explains SPF DKIM DMARC in plain English, shows what each record looks like, how to add them in the right order, how to test them, and what they mean for the emails your WordPress forms send. You do not need to be a developer to follow it.

Why SPF DKIM DMARC matter now

For years, email worked on trust. Anyone could send a message claiming to be from any address, and receiving servers had few ways to tell. Spammers and phishers took full advantage.

That has changed. Google’s sender guidelines now ask every sender to authenticate their mail, and since February 2024 Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC in place. A small business site is not a bulk sender, but its unauthenticated mail is exactly what the filters are tuned to catch. Without SPF DKIM DMARC, form notifications, password resets and receipts increasingly land in spam, or never arrive.

SPF DKIM DMARC at a glance

Think of it as a building. SPF is the list of people allowed in. DKIM is the signature on each letter they carry out. DMARC is the instruction to the post office about what to do with a letter that fails either check.

SPF: who may send for your domain

SPF (Sender Policy Framework) is a single TXT record on your domain that lists the servers allowed to send email for it. A typical record looks like this:

v=spf1 include:_spf.google.com include:spf.brevo.com ~all

• v=spf1 says this is an SPF record.
• Each include: adds the servers of one service that sends for you: your mailbox provider, your newsletter tool, your SMTP service.
• ~all means “anything else is suspicious”. -all is stricter and means “reject anything else”.

Two rules catch most people out. First, a domain must have only one SPF record. Two records make both invalid, so add new services to the existing record instead. Second, SPF allows at most 10 DNS lookups, and every include: counts. If you use many services, remove the ones you no longer use.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The sending server signs the message with a private key, and publishes the matching public key in your DNS. The receiving server checks the signature against that key. If the message was changed on the way, or was not signed by your domain, the check fails.

You do not write DKIM records yourself. Each service that sends for you generates a key and tells you what to publish, usually a TXT or CNAME record with a name like google._domainkey or brevo1._domainkey. The first part is called the selector, and it lets several services each have their own key.

In practice: open each service that sends email for your domain, find its “domain authentication” or “DKIM” page, and add the record it gives you. Then turn signing on in that service.

DMARC: what to do when a check fails

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together. It is a TXT record at _dmarc.yourdomain.com, for example:

v=DMARC1; p=none; rua=mailto:[email protected]

• p=none means “only watch and report”. Start here.
• p=quarantine asks receivers to send failing mail to spam.
• p=reject asks them to refuse it outright.
• rua= is where daily reports go, so you can see who is sending as your domain.

DMARC also checks alignment: the domain in the visible From address must match the domain SPF or DKIM checked. This is why a form that sends “from” a visitor’s Gmail address fails DMARC even when your server is set up perfectly.

How to add SPF DKIM DMARC, step by step

1. List everything that sends email as your domain: your mailbox provider, your website (form notifications, password resets, shop receipts), your newsletter tool, your help desk.
2. Create or update one SPF record that includes each of them.
3. Turn on DKIM in each service and publish the key it gives you.
4. Add a DMARC record at p=none with a report address.
5. Wait a day, then send test emails and read the headers.
6. Read the DMARC reports for two to four weeks. When every real sender passes, move to p=quarantine, and later to p=reject if you want.

You add these records wherever your domain’s DNS is managed. That is often your domain registrar, your host, or a service such as Cloudflare. WordPress itself does not hold DNS records.

SPF DKIM DMARC for common email providers

Every provider documents its own values, and they change from time to time, so always copy from your provider’s current help page. As a starting point, these are the SPF includes and DKIM steps for services small businesses use most:

If you use Google Workspace for your mailbox and Brevo for newsletters, your one SPF record would include both, and each service would have its own DKIM key under its own selector. That is SPF DKIM DMARC working as designed: one list, several signatures, one policy.

How to read a DMARC report

Once your DMARC record has a rua= address, the big providers send a daily report for every day they received mail claiming to be from your domain. The reports are XML files, which are hard to read by eye, so most people use a free report viewer that turns them into a simple table.

What you are looking for is short:

• Sources you recognise that fail. A service you use that fails SPF or DKIM needs to be added to your SPF record or have DKIM turned on.
• Sources you do not recognise. These are usually spammers pretending to be you. Once your real senders all pass, a stricter policy stops them.
• Volume. A sudden jump in mail from your domain that you did not send is worth a closer look.

After two to four weeks of clean reports, you can tighten the policy with confidence. That is the real value of starting SPF DKIM DMARC at p=none: you learn what sends as your domain before anything gets blocked.

Subdomains and separate sending

Many businesses send marketing email from a subdomain, such as news.yourdomain.com, and keep the main domain for everyday mail and website notifications. This keeps the reputation of the two apart: if a campaign gets complaints, your form notifications are not affected.

Each subdomain that sends mail needs its own SPF record and DKIM keys. DMARC on the main domain covers subdomains by default, unless you set a separate policy with sp=. For a small site, one domain for everything is fine, as long as SPF DKIM DMARC cover every service that uses it.

What SPF DKIM DMARC mean for your WordPress forms

Here is the part most guides skip. Your DNS records only protect email that is sent from your domain, through a server those records name. A WordPress site breaks that in two common ways:

• It sends through the web server. WordPress’s default mail() goes out through your host’s web server, which your SPF record probably does not include, and which does not sign with your DKIM key.
• It sends from the wrong address. [email protected] often does not exist, and some form plugins put the visitor’s own address in From, which can never pass DMARC alignment.

The fix is to send every site email from a real mailbox on your domain, through that mailbox provider’s SMTP server, which your SPF DKIM DMARC setup already covers. FillKite has SMTP built in under Settings → Email sending, so no separate plugin is needed.

Check your records from WordPress

You do not need to read raw DNS to know whether your setup is right. FillKite has a Check my sender domain link on the Email settings screen. It looks up SPF DKIM DMARC for the domain of your From address and tells you in plain English what it found and what to add.

DKIM is the one it cannot always confirm, because each provider picks its own selector name. If the check says it could not find a key under the usual names, that is not proof it is missing: open your email provider and make sure DKIM signing is turned on.

Test with a real email

The final proof is in a received message. Send a form entry to a personal Gmail address, open the message, choose Show original from the menu, and look at the top of the page:

SPF:   PASS with IP 203.0.113.10
DKIM:  'PASS' with domain yourdomain.com
DMARC: 'PASS'

Three passes mean your SPF DKIM DMARC setup works for that email. In Outlook, open the message headers and look for spf=pass, dkim=pass and dmarc=pass in the Authentication-Results line.

Where SPF DKIM DMARC go wrong

Spam coming in through your forms is a separate problem; see how to stop WordPress form spam. If you have added the records and form emails still go missing, the cause is usually on the WordPress side. Our guide to fixing a form not sending email covers sender addresses, SMTP and logs in detail.

When everything passes but mail still lands in spam

Passing SPF DKIM DMARC proves who you are. It does not prove you are welcome. If all three pass and your messages still land in spam, look at these next:

• Content. A notification that is mostly a long list of links, or an auto-reply stuffed with sales phrases, looks like spam whoever sends it. Keep form emails short and plain.
• Complaints. If recipients mark your mail as spam, providers learn from it. Only send auto-replies to people who asked for them.
• A new domain. A domain that has never sent mail has no reputation yet. It builds over a few weeks of normal, wanted email.
• A shared server. Sending through a web host’s shared server can carry other sites’ bad reputation. SMTP through your mailbox provider avoids that.

For form emails specifically, the mix that works is simple: SPF DKIM DMARC in place, a real From address on your domain, SMTP, and short messages that people expect to receive.

Keep checking after setup

SPF DKIM DMARC are not a one-time job. A new newsletter tool, a changed host, or a DNS edit by someone else can break them months later, and nobody notices until a customer complains.

Two habits catch problems early. First, keep your DMARC report address and glance at the reports each month. Second, test your site’s email regularly. FillKite can send one short test email a day, the same way form notifications go out, and warns you in WordPress if it fails, before a real lead is missed. Every entry is also saved before any email is sent, so a broken record never costs you the lead itself.

Frequently asked questions

Do I need all three of SPF DKIM DMARC?

Yes, for reliable delivery. SPF and DKIM each prove part of the story, and DMARC is what the big providers look for to decide how to treat failures. Having all three is now the baseline.

How long do SPF DKIM DMARC records take to work?

Usually minutes to a few hours, depending on your DNS provider. Some changes take up to 48 hours to reach everywhere, so test again the next day.

Will SPF DKIM DMARC stop my emails going to spam?

They remove the most common reason, but not every reason. Content, sending volume and complaints also matter. For form emails, authentication plus a real From address and SMTP solves the vast majority of cases.

What is the difference between ~all and -all in SPF?

~all is a soft fail: mail from servers not on the list is marked suspicious but usually still delivered. -all is a hard fail that asks receivers to reject it. With DMARC in place, ~all is the common, safer choice, because DMARC decides the final outcome.

Can I break my email by adding DMARC?

Not at p=none, which only reports. Problems start when you move to quarantine or reject before every service that sends for you passes, which is why you read the reports first.

Does my form plugin need its own SPF DKIM DMARC records?

No. The records belong to your domain and the service that sends the mail, not to a plugin. What the plugin controls is the From address and how the email leaves your site. Send from your own domain through SMTP, and the records you already have cover it.

Do I need a developer to set this up?

No. Each service gives you the exact record to copy, and you paste it into your DNS settings. The hardest part is making a complete list of everything that sends email as your domain.