DKIM, SPF and DMARC in plain English
Three checks that decide whether your mail is believed.
Email was designed without any way to prove who sent a message. These three fill that gap. You mostly don’t have to do anything about them — verifying a domain sets them up — but knowing what they’re for makes every deliverability conversation easier.
The three, briefly
| Answers | Like | |
|---|---|---|
| SPF | Is this server allowed to send for this domain? | A list of who may post on your behalf |
| DKIM | Was this message really sent by that domain, unaltered? | A wax seal on the envelope |
| DMARC | What should a receiver do when those fail? | Your standing instruction to the post office |
DKIM is the one that matters most
Every message is signed with a private key. The matching public key lives in your DNS — that’s what those CNAME records are. A receiver checks the signature: if it matches, the message genuinely came from a sender authorised for that domain and wasn’t modified.
It’s the strongest of the three because it survives forwarding, which SPF often doesn’t.
Alignment — the word that trips people up
It isn’t enough that a message is signed. It has to be signed by a domain that matches the From address. That match is called alignment, and it’s what DMARC actually checks.
Why you can't send as your Gmail address
This is exactly why. A message with From: you@gmail.com signed by anyone other than Google is unaligned, so DMARC fails and the mail is refused or binned. No platform can work around it — it’s the system working.
What we handle
- DKIM — set up when you verify a domain, or automatically on a free sending address.
- SPF — handled by how sending is configured; there’s nothing for you to add.
- DMARC — a policy on your domain, so it’s yours to publish. Not required to send with us, and worth doing anyway.
If you publish a DMARC record, start at p=none — monitoring only. It tells you what’s failing without anything being rejected. Tighten later, once a few weeks of reports look clean.
FAQs
Do I need DMARC to send?+
Not with us. Gmail and Yahoo do require it of high-volume senders on their own terms, and it protects your domain from being spoofed, so it’s worth having.
How do I check my mail is signed?+
Send yourself a test and view the original message — in Gmail, ⋮ → Show original. You want dkim=pass and dmarc=pass.
I don't have a domain. Does any of this apply?+
It’s all handled for you on a free sending address — that address is on a domain we control and sign for, which is precisely what makes it work.