Recommended Free Tools
SPF, DKIM and DMARC are three related email-authentication standards, but they do different jobs. SPF checks whether a sending system is authorized for a domain; DKIM lets a receiver verify a message’s cryptographic signature; and DMARC checks whether SPF or DKIM authentication aligns with the domain readers see in the From address. To put them to work, inventory every service that sends mail for your domain, configure each service’s SPF and DKIM settings, publish a DMARC policy, and monitor reports before enforcing a stricter policy.
What SPF, DKIM and DMARC each do
A useful way to separate the three is to ask three questions: Is this sending system authorized? Is this message signed by a domain that can be verified? Does an authenticated domain match the address shown to the recipient?
As an Amazon Associate I earn from qualifying purchases.
SPF: Is the sender authorized?
Sender Policy Framework (SPF) is a DNS-published policy that receivers use to check whether a sending system is authorized for a domain. SPF evaluates a mail-sending identity; that identity is not necessarily the visible address in the message’s From field. SPF authentication by itself therefore does not establish that the visible From domain is authenticated. See the IETF’s RFC 7208.
DKIM: Can the message’s signature be verified?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to a message. A receiver can use the corresponding public key published in DNS to check the signature. A valid DKIM signature authenticates the signing domain, but it does not by itself guarantee that this domain matches the visible From domain. The IETF discusses authentication in internationalized email in RFC 8616.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
DMARC: Does authentication align with the visible From domain?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks whether an authenticated SPF or DKIM identifier aligns with the domain in the RFC 5322 From header—the address domain recipients see. A message passes DMARC when at least one of those authenticated identifiers aligns. DMARC also lets a domain owner publish a policy for receivers and receive aggregate reports about authentication results. The current specification is the IETF’s RFC 9989.
DMARC alignment can be relaxed or strict. Relaxed alignment allows matching organizational domains; strict alignment requires the domains to be identical. Which mode applies depends on the domain owner’s policy. Authentication and alignment are distinct: a message can pass SPF or DKIM authentication but still fail DMARC if neither authenticated domain aligns with the visible From domain.
Do you need all three for Gmail?
Google’s Gmail sender guidelines say all senders need SPF or DKIM. Senders who send more than 5,000 messages per day to Gmail must use SPF, DKIM and DMARC; Google says the DMARC policy can be p=none for this requirement. Google’s guidelines say these requirements began February 1, 2024. This is Gmail’s policy, not a universal rule for every receiving service. Google recommends that all senders set up all three. Check the live Gmail sender guidelines for current requirements.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For direct mail to personal Gmail accounts, Google says a bulk sender’s From organizational domain must align with SPF or DKIM to satisfy its alignment requirement. Google recommends aligning both. Its sender FAQ addresses indirect mail, such as forwarding and mailing lists, where authentication results can be affected.
How to set up SPF, DKIM and DMARC safely
The exact DNS records depend on every legitimate service sending mail for your domain and how those services are configured. Get the required values from each email provider and publish them through your DNS host; there is no safe one-size-fits-all record to copy.
- Inventory your legitimate senders. List every service that sends using your domain, including business email, website forms, newsletters, billing systems and other automated mail. Include any separate sending services or subdomains your organization uses.
- Configure SPF with each provider’s instructions. Identify the sending identity the provider uses and follow its DNS instructions for authorizing its sending systems. SPF authorization is tied to a domain identity, so do not assume that authorizing one visible From address automatically covers every service.
- Enable DKIM signing. Use each provider’s setup instructions to enable signing for the domain you want to authenticate. Publish the provider’s public-key DNS value and confirm the service signs messages with the intended domain.
- Check alignment against the visible From domain. Confirm that at least one authenticated identifier—SPF or DKIM—aligns with the domain in the From header. Where your setup allows it, align both, as Gmail recommends for bulk senders.
- Publish a DMARC policy and arrange aggregate-report collection. Use the policy record and reporting configuration appropriate to your domain, following the current specification and your provider’s guidance. The Gmail bulk-sender requirement permits
p=none; that is a monitoring policy, not a command to reject failing mail. - Review reports before tightening enforcement. Compare reported traffic with your inventory. Fix legitimate services that are missing, misconfigured or not aligned before considering a stricter policy. The current DMARC specification describes full participation as including aligned SPF and DKIM, collecting and analyzing aggregate reports, and publishing the policy record.
RFC 9989 says, “To fully participate in DMARC, Domain Owners:” and then sets out the specification’s requirements. In practical terms, publishing a record is only part of operating DMARC: you also need to understand the reports and address legitimate mail that does not authenticate as intended.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Why DMARC can fail even when SPF or DKIM passes
DMARC is not simply a combined SPF-and-DKIM pass/fail check. It requires at least one authenticated identifier to align with the visible From domain. These are common reasons a message can fail that test:
- SPF passes for a different domain. The sending system may be authorized for its own or a provider’s domain, but that domain may not align with the domain in From.
- DKIM passes for a different signing domain. A valid signature still does not satisfy DMARC if its domain does not align with the visible From domain.
- A legitimate sender was missed. A website, billing platform, mailing service or other sender may not have been included in the domain’s configuration.
- Forwarding or mailing-list handling changes the result. Gmail identifies indirect mail as a special case; forwarding and mailing lists can affect SPF and alignment. Examine the reported authentication results rather than assuming all failures came from the original sender.
- The alignment mode is stricter than the domain setup supports. Strict alignment requires identical domains, while relaxed alignment permits matching organizational domains. Check the policy’s alignment settings against the domains your services actually use.
Use aggregate reports to identify which systems are sending, what authentication results they receive and whether their domains align. Correct legitimate traffic first; a failing result is not, by itself, proof that a sender is malicious.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What authentication does—and does not—guarantee
SPF, DKIM and DMARC help receivers assess whether mail is authorized and whether authentication matches the visible sending domain. They do not prove that a message’s content is legitimate, and they do not guarantee inbox placement. Gmail says authentication can help protect domains and reduce the chance of rejection or spam placement, but delivery also depends on other requirements and receiver handling.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For a provider or mail service, evaluate whether it supports every service that sends for your domain, allows the needed SPF and DKIM alignment, provides usable aggregate-report analysis, and supplies DNS setup instructions for your configuration. This is a practical checklist, not a guarantee that any provider will deliver mail to the inbox.
Sources and specification status
RFC 9989 is the current DMARC specification cited here. RFC 7489 is the earlier 2015 DMARC document, useful as background but not the current specification. The protocol references are the IETF’s RFC 7208 for SPF, RFC 8616 for email authentication in the internationalized-mail context, and RFC 9989 for DMARC.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
