Anyone can write your address in the From line of an e-mail. Three DNS records let receivers check whether it really came from you. SPF lists the servers allowed to send for your domain. DKIM signs each message. DMARC tells receivers what to do when a message fails, and sends you reports.
SPF: the list of who may send
SPF (Sender Policy Framework) is a list you publish of the servers allowed to send mail for your domain. A receiver compares the sending server with your list.
v=spf1 include:spf.protection.outlook.com -all
This one says: Microsoft 365 may send for us, nobody else. Each service you use (newsletter tool, invoicing, webshop) needs to be on the list, or sign with DKIM.
include: costs DNS lookups, and past 10 the record stops working. The free SPF surveyor counts them for you.DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your mail service signs with a private key; you publish the matching public key in DNS. The receiver checks the signature with that key. If someone changed the message on the way, or never had the key, the check fails.
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…
You rarely write this record yourself. Microsoft 365, Google Workspace and newsletter tools give you the exact record, or a CNAME pointing to theirs. selector1 is the key's name, so one domain can have a key per service.
DMARC: your instruction, and your reports
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together with the address people see. A message passes DMARC when SPF or DKIM passes for the same domain as the From address. That match is called alignment.
Your DMARC record then tells receivers two things: what to do with mail that fails, and where to send reports.
v=DMARC1; p=none; rua=mailto:reports@yourcompany.dk
p=none: change nothing, send reports. Where everyone starts.p=quarantine: treat failing mail as suspicious, usually the spam folder.p=reject: refuse failing mail. Forged mail from your domain fails.
Without DMARC, the owner of a misused domain isn't told about the misuse, as Styrelsen for Samfundssikkerhed puts it. The reports are how you find out who sends as you.
How the three work together
| Record | The question it answers | Where it lives |
|---|---|---|
| SPF | Was this server allowed to send for the domain? | yourcompany.dk |
| DKIM | Was this message signed by the domain, and unchanged? | [selector]._domainkey.yourcompany.dk |
| DMARC | Does a pass match the From address, and what if it doesn't? | _dmarc.yourcompany.dk |
Since 2024, Gmail and Yahoo require SPF, DKIM and a DMARC record from anyone who sends them a lot of mail, and Outlook.com has done the same since May 2025. From every other sender, Gmail and Yahoo ask for SPF or DKIM.
What to do next
- Check your domain. The free check shows which of the three you have, and one next step.
- Publish DMARC with reports, starting at
p=none. - Follow the road to reject. Your road to p=reject, step by step shows the way.
Sources
- Styrelsen for Samfundssikkerhed, "Vejledning om phishing", 7 Oct 2022, samsik.dk (our translation).
- Google, Email sender guidelines, support.google.com/a/answer/81126 (read 12 Nov 2026).
- Yahoo Sender Hub, Sender best practices, senders.yahooinc.com (Feb 2024).
- Microsoft, Outlook's requirements for high-volume senders, 2 Apr 2025, techcommunity.microsoft.com.