SPF vs DKIM vs DMARC explained (what each one actually does)
SPF authorizes which servers can send for your domain, DKIM signs messages so they can't be tampered with, and DMARC tells receivers what to do when SPF/DKIM fail. You need all three.
Short answer: SPF says *which servers are allowed* to send email for your domain. DKIM adds a *cryptographic signature* so receivers can confirm the message wasn't altered and really came from you. DMARC ties the two together and tells receivers *what to do* (none / quarantine / reject) when SPF or DKIM fails — and it sends you reports. Cold email needs all three passing.
What each record does
- SPF (TXT record): lists the IPs and services allowed to send for you. Stops spoofing from unauthorized servers.
- DKIM (TXT record + signature): a public key receivers use to verify your signed mail. Stops tampering.
- DMARC (TXT record): policy plus reporting. Aligns SPF and DKIM to your domain and tells receivers how to handle failures.
Why all three
SPF or DKIM on its own leaves gaps. DMARC is what Gmail and Yahoo now effectively require from bulk senders — start at p=none to monitor, then move to quarantine.
Autocloz checks all three on every connected domain and flags anything missing before your first send.
> Start free — connect a domain and Autocloz verifies SPF, DKIM and DMARC.