{"id":2133,"date":"2026-02-24T12:27:03","date_gmt":"2026-02-24T11:27:03","guid":{"rendered":"https:\/\/woodpecker.co\/blog\/?p=2133"},"modified":"2026-08-03T13:09:55","modified_gmt":"2026-08-03T12:09:55","slug":"spf-dkim","status":"publish","type":"post","link":"https:\/\/woodpecker.co\/blog\/spf-dkim\/","title":{"rendered":"What Is SPF, DKIM &#038; DMARC? (+ How to Set Them Up in 2026)"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">SPF, DKIM and DMARC are email authentication protocols that prove messages are connected to the domain they claim to represent. Together, they reduce domain spoofing, give receiving servers more information about legitimate mail and support reliable email delivery.<\/span><\/p>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 12%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Element<\/th>\n<th style=\"width: 40%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Standard business email<\/th>\n<th style=\"width: 48%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Cold email<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Subject line<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">States the topic or requested action<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Establishes relevant context without clickbait<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Greeting<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Matches the existing relationship<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Uses the prospect\u2019s name<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Opening<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Refers to shared work or an earlier conversation<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Shows why this particular person was contacted<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Body<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Provides the necessary details<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Connects one problem or goal to a concise value proposition<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">CTA<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Requests a specific action<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Asks one low-friction question<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Signature<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">May include full contact details<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Remains short and credible<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Length<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Depends on the context<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Usually shorter than standard correspondence<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">In short, SPF checks the sending source, DKIM verifies a message signature, and DMARC connects those checks to the domain recipients see.<\/span><\/p>\n<h3><b>TL;DR<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SPF authorizes sending servers.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DKIM signs outgoing messages.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DMARC checks domain alignment and sets a failure policy.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DMARC passes when either aligned SPF or aligned DKIM passes.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SPF commonly breaks during forwarding, while DKIM may survive if the signed content remains unchanged.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Gmail, Yahoo and Outlook.com require all three protocols for high-volume senders.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Lower-volume requirements vary, but configuring all three remains the safest baseline in 2026.<\/span><\/li>\n<\/ul>\n<p><b>Want to check your authentication status?<\/b><span style=\"font-weight: 400;\"> Run a<\/span><a href=\"https:\/\/woodpecker.co\/help-center\/en\/articles\/5234530-what-is-a-domain-check-up\"> <span style=\"font-weight: 400;\">Woodpecker Domain Check-Up<\/span><\/a><span style=\"font-weight: 400;\"> from Settings \u2192 Accounts \u2192 select your mailbox \u2192 Domain Check-Up.<\/span><\/p>\n<h2><b>How SPF, DKIM and DMARC work together<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The three protocols solve different parts of the same problem.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When an email arrives, the receiving server may ask:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>SPF:<\/b><span style=\"font-weight: 400;\"> Is this sending server authorized by the domain used in the message envelope?<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>DKIM:<\/b><span style=\"font-weight: 400;\"> Does the message have a valid cryptographic signature from the signing domain?<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>DMARC:<\/b><span style=\"font-weight: 400;\"> Does the domain that passed SPF or DKIM align with the domain visible in the From address?<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>DMARC policy:<\/b><span style=\"font-weight: 400;\"> If neither aligned check passes, should the message be monitored, quarantined or rejected?<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">SPF and DKIM provide authentication results. DMARC connects those results to the visible From domain and tells receivers how the domain owner wants failures handled.<\/span><\/p>\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-large wp-image-51113\" src=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/1_1_11zon-1024x640.jpg\" alt=\"Email authentication process checking the sending source, message signature, and domain alignment to produce a trust signal.\" width=\"1024\" height=\"640\" srcset=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/1_1_11zon-1024x640.jpg 1024w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/1_1_11zon-300x188.jpg 300w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/1_1_11zon-768x480.jpg 768w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/1_1_11zon-1536x961.jpg 1536w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/1_1_11zon.jpg 1586w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 1050px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 27%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Feature<\/th>\n<th style=\"width: 19%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">SPF<\/th>\n<th style=\"width: 28%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">DKIM<\/th>\n<th style=\"width: 26%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">DMARC<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Main purpose<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Authorize sending sources<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Verify a cryptographic signature<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Check alignment and apply a policy<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Published in DNS<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Common record type<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">TXT<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">TXT or provider-supplied CNAME<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">TXT<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Checks sending IP<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Uses the SPF result<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Checks message integrity<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Uses the DKIM result<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Provides reports<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Usually survives forwarding<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Often, if signed content remains intact<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">May pass through aligned DKIM<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Reduces direct domain spoofing alone<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Partially<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Partially<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Strongly at an enforcement policy<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">DNS examples in this article use <\/span><span style=\"font-weight: 400;\">example.com<\/span><span style=\"font-weight: 400;\"> and placeholder values. Do not copy them into a production domain without replacing the sending services, selector, public key and reporting address with your own information.<\/span><\/p>\n<h2><b>What is SPF?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">SPF stands for Sender Policy Framework. It is a DNS-based authentication method that identifies the servers permitted to send mail using a domain in the SMTP envelope.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Suppose your company uses Google Workspace for employee mail and another platform for transactional messages. Your SPF record should authorize every legitimate service that sends using your domain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When a message arrives, the receiving server:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reads the domain from the Return-Path or SMTP MAIL FROM address.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Looks up that domain\u2019s SPF record.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Compares the sending IP address with the authorized sources.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Returns an SPF result such as pass, fail, softfail or neutral.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">SPF does not directly authenticate the From address displayed in the recipient\u2019s inbox. DMARC adds that alignment check.<\/span><\/p>\n<h3><b>Basic SPF record example<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">v=spf1 include:_spf.google.com ~all<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This record contains three parts:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">v=spf1<\/span><span style=\"font-weight: 400;\"> identifies the SPF version.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">include:_spf.google.com<\/span><span style=\"font-weight: 400;\"> authorizes servers covered by Google\u2019s SPF record.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">~all<\/span><span style=\"font-weight: 400;\"> marks other sources as a soft fail.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The correct value depends on every platform sending mail for your domain. Follow each provider\u2019s official instructions before changing the record.<\/span><\/p>\n<h3><b>SPF setup table<\/b><\/h3>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 750px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 17%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Record type<\/th>\n<th style=\"width: 39%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Where it goes<\/th>\n<th style=\"width: 44%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Example value<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">TXT<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Root domain, often entered as @<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">v=spf1 include:_spf.google.com ~all<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">DNS interfaces label the root differently. Some use <\/span><span style=\"font-weight: 400;\">@<\/span><span style=\"font-weight: 400;\">, while others expect the domain name or an empty Host field.<\/span><\/p>\n<h3><b>What should you include in SPF?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Include services that send using their own infrastructure on behalf of your domain.<\/span><\/p>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 16%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Sending service<\/th>\n<th style=\"width: 33%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Include in SPF?<\/th>\n<th style=\"width: 51%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Example mechanism<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Google Workspace<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">include:_spf.google.com<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Microsoft 365<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">include:spf.protection.outlook.com<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Mailchimp<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes, if it sends for the domain<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Use the value provided by Mailchimp<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Help Scout<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes, if it sends for the domain<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Use the value provided by Help Scout<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Amazon SES<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes, where required by the configuration<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Use the SES value provided for your setup<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Woodpecker<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No separate Woodpecker include<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Woodpecker sends through your connected mailbox and SMTP<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">Woodpecker does not need to be added as a separate SPF sender because messages are sent through the mailbox you connect. The email provider or SMTP service behind that mailbox still needs to be authorized.<\/span><\/p>\n<h3><b>How to set up SPF<\/b><\/h3>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">List every platform that sends email for your domain.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Check whether an SPF record already exists.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Obtain the official SPF mechanism from every sending provider.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Combine legitimate sources into one SPF record.<\/span><\/li>\n<\/ol>\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-large wp-image-51137\" src=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/2_2_11zon-1024x640.jpg\" alt=\"Employee mail, CRM, support, and transactional systems combined within one SPF record instead of separate record.\" width=\"1024\" height=\"640\" srcset=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/2_2_11zon-1024x640.jpg 1024w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/2_2_11zon-300x188.jpg 300w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/2_2_11zon-768x480.jpg 768w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/2_2_11zon-1536x961.jpg 1536w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/2_2_11zon.jpg 1586w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\n<p><span style=\"font-weight: 400;\">5. Publish the record as TXT at the correct DNS host.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">6. Wait for DNS propagation.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">7. Test the record and send a message to confirm SPF passes.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If Google Workspace is your only sending service, the record may look like this:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">v=spf1 include:_spf.google.com ~all<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">If Google Workspace and another authorized service both send mail, the record may contain more than one mechanism:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">v=spf1 include:_spf.google.com include:example-sender.com ~all<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Replace <\/span><span style=\"font-weight: 400;\">example-sender.com<\/span><span style=\"font-weight: 400;\"> with the value provided by the actual service.<\/span><\/p>\n<h3><b>Common SPF mistakes<\/b><\/h3>\n<h4><b>Publishing more than one SPF record<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">A domain should have one SPF TXT record. If several services send mail, combine their mechanisms into the same record.<\/span><\/p>\n<h4><b>Forgetting a legitimate sending service<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Support tools, CRMs, newsletter platforms, transactional email services and other systems may send mail using your domain. Missing one may cause its messages to fail SPF.<\/span><\/p>\n<h4><b>Exceeding the lookup limit<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">SPF evaluation permits no more than 10 DNS-querying mechanisms. Too many nested <\/span><span style=\"font-weight: 400;\">include<\/span><span style=\"font-weight: 400;\"> statements may produce a permanent SPF error.<\/span><\/p>\n<h4><b>Using copied values without checking the provider<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">An SPF record that works for another company may not represent your sending infrastructure. Build the record from the services your domain actually uses.<\/span><\/p>\n<h4><b>Assuming SPF authenticates the visible From address<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">SPF checks the SMTP envelope domain. DMARC determines whether that authenticated domain aligns with the From address shown to the recipient.<\/span><\/p>\n<h2><b>What is DKIM?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">DKIM stands for DomainKeys Identified Mail. It attaches a cryptographic signature to selected parts of an outgoing email.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The sending service uses a private key to create the signature. The corresponding public key is published in DNS. A receiving server retrieves that public key and uses it to validate the signature.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">A successful DKIM check indicates that:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The message was signed by a system holding the private key for the signing domain.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The signed headers and body content were not altered in a way that invalidates the signature.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">DKIM uses a <\/span><b>selector<\/b><span style=\"font-weight: 400;\"> so a domain may publish and rotate multiple keys. The selector appears in the DKIM signature and tells the receiving server where to find the correct public key.<\/span><\/p>\n<h3><b>Basic DKIM record example<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">v=DKIM1; k=rsa; p=&lt;PUBLIC_KEY_FROM_YOUR_PROVIDER&gt;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">&lt;PUBLIC_KEY_FROM_YOUR_PROVIDER&gt;<\/span><span style=\"font-weight: 400;\"> is a placeholder. Your email provider generates the actual public key and selector.<\/span><\/p>\n<h3><b>DKIM setup table<\/b><\/h3>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 24%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Record type<\/th>\n<th style=\"width: 29%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Where it goes<\/th>\n<th style=\"width: 47%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Example value<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">TXT or provider-supplied CNAME<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">&lt;selector&gt;._domainkey.example.com<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">v=DKIM1; k=rsa; p=&lt;PUBLIC_KEY_FROM_YOUR_PROVIDER&gt;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">Some providers publish DKIM through TXT records. Others, including certain Microsoft 365 configurations, provide CNAME records. Use the record type, selector and value generated in your email administrator panel.<\/span><\/p>\n<h3><b>How to set up DKIM<\/b><\/h3>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Open your email provider\u2019s administrator console.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Find the DKIM or email authentication settings.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Generate a DKIM key and selector.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Copy the supplied TXT or CNAME record.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Add it to your DNS configuration.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Wait for the record to propagate.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Return to the email provider and enable DKIM signing.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Send a test message and verify that DKIM passes.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">Publishing the DNS record does not always activate signing. Google Workspace and other providers may require you to return to the admin console and start authentication after DNS propagation.<\/span><\/p>\n<h3><b>Common DKIM mistakes<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Publishing the key under the wrong selector<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Leaving out <\/span><span style=\"font-weight: 400;\">._domainkey<\/span><span style=\"font-weight: 400;\"> from the DNS host<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Copying an incomplete public key<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Adding quotation marks or spaces not expected by the DNS provider<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Publishing the record but forgetting to activate signing<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Leaving old selectors active indefinitely after rotating keys<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Assuming that a valid signature automatically passes DMARC<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">DKIM may pass even if its signing domain differs from the visible From domain. DMARC requires those domains to align.<\/span><\/p>\n<h2><b>SPF vs. DKIM: what is the difference?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">SPF authenticates the sending source. DKIM authenticates a cryptographic signature attached to the message.<\/span><\/p>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 32%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Question<\/th>\n<th style=\"width: 40%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">SPF<\/th>\n<th style=\"width: 28%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">DKIM<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">What does it check?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Whether the sending IP is authorized<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Whether the signature is valid<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Which domain does it use?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">SMTP MAIL FROM or Return-Path domain<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Domain in the DKIM d= tag<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Does it verify content integrity?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes, for signed content<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Does it usually survive forwarding?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">No<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Often<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Does it require a DNS record?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Is it enough for DMARC?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes, if it passes and aligns<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes, if it passes and aligns<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Should you configure both?<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">SPF often fails after forwarding because the forwarding server\u2019s IP is not listed in the original sender\u2019s SPF record.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">DKIM may continue to pass because the signature travels with the message. However, forwarding services that modify signed headers or body content may break the signature.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For this reason, configuring both provides more resilience than relying on either method alone.<\/span><\/p>\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-large wp-image-51119\" src=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/3_3_11zon-1024x640.jpg\" alt=\"Email forwarding changing the sending IP and potentially breaking SPF while an unchanged DKIM signature may remain valid.\" width=\"1024\" height=\"640\" srcset=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/3_3_11zon-1024x640.jpg 1024w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/3_3_11zon-300x188.jpg 300w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/3_3_11zon-768x480.jpg 768w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/3_3_11zon-1536x961.jpg 1536w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/3_3_11zon.jpg 1586w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\n<h2><b>What is DMARC?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">DMARC stands for Domain-based Message Authentication, Reporting and Conformance.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">It builds on SPF and DKIM by checking whether an authenticated domain aligns with the domain displayed in the From address.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">DMARC also lets the domain owner:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Publish a policy for messages that fail authentication<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Receive aggregate reports about email using the domain<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Identify unknown or unauthorized sending sources<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Move gradually from monitoring to enforcement<\/span><\/li>\n<\/ul>\n<h3><b>Basic DMARC record example<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This example contains:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">v=DMARC1<\/span><span style=\"font-weight: 400;\"> \u2014 the DMARC version<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">p=none<\/span><span style=\"font-weight: 400;\"> \u2014 a monitoring policy<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">rua=mailto:&#8230;<\/span><span style=\"font-weight: 400;\"> \u2014 the address that receives aggregate reports<\/span><\/li>\n<\/ul>\n<h3><b>DMARC setup table<\/b><\/h3>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 800px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 15%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Record type<\/th>\n<th style=\"width: 22%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Where it goes<\/th>\n<th style=\"width: 63%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Example value<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">TXT<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">_dmarc.example.com<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">Replace <\/span><span style=\"font-weight: 400;\">example.com<\/span><span style=\"font-weight: 400;\"> and the reporting address before publishing the record.<\/span><\/p>\n<h2><b>How DMARC authentication and alignment work<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">DMARC evaluates two possible paths:<\/span><\/p>\n<h3><b>SPF path<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">For DMARC to pass through SPF:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SPF must pass.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The authenticated MAIL FROM domain must align with the visible From domain.<\/span><\/li>\n<\/ol>\n<h3><b>DKIM path<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">For DMARC to pass through DKIM:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DKIM must pass.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The domain in the DKIM <\/span><span style=\"font-weight: 400;\">d=<\/span><span style=\"font-weight: 400;\"> tag must align with the visible From domain.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">DMARC passes if at least one of these paths passes with alignment.<\/span><\/p>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 750px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 20%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">SPF result<\/th>\n<th style=\"width: 23%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">DKIM result<\/th>\n<th style=\"width: 31%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Alignment<\/th>\n<th style=\"width: 26%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">DMARC result<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Fail<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">SPF aligned<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Fail<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">DKIM aligned<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">At least one aligned<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Pass<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Neither aligned<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Fail<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Fail<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Fail<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">None<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Fail<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">SPF and DKIM do not both need to pass for DMARC to pass. Still, configuring both correctly protects delivery when one authentication path breaks.<\/span><\/p>\n<h2><b>DMARC alignment: relaxed vs. strict<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">DMARC supports two alignment modes.<\/span><\/p>\n<h3><b>Relaxed alignment<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The authenticated domain and From domain may use different subdomains of the same organizational domain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For example:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">From domain: <\/span><span style=\"font-weight: 400;\">example.com<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DKIM domain: <\/span><span style=\"font-weight: 400;\">mail.example.com<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">These may align under relaxed alignment.<\/span><\/p>\n<h3><b>Strict alignment<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The authenticated domain must match the From domain exactly.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Strict alignment offers tighter control but may require more careful configuration across subdomains and sending platforms.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Most domains start with relaxed alignment unless their security requirements justify a stricter approach.<\/span><\/p>\n<h2><b>DMARC policies<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">DMARC supports three main policies:<\/span><\/p>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 11%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Policy<\/th>\n<th style=\"width: 54%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">What it tells receivers<\/th>\n<th style=\"width: 35%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Recommended stage<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">p=none<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Monitor failures without requesting quarantine or rejection<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Initial discovery and reporting<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">p=quarantine<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Treat failing messages as suspicious, commonly placing them in spam<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">After legitimate senders have been identified<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">p=reject<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Reject messages that fail DMARC<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Full enforcement after testing<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">A <\/span><span style=\"font-weight: 400;\">p=none<\/span><span style=\"font-weight: 400;\"> record provides visibility but does not actively request that receivers block impersonating messages. The long-term security goal is usually <\/span><span style=\"font-weight: 400;\">p=reject<\/span><span style=\"font-weight: 400;\">, reached after legitimate sending sources consistently authenticate.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">A stricter policy should not be introduced blindly. If an unlisted platform sends legitimate mail for your domain, enforcement may disrupt that traffic.<\/span><\/p>\n<h2><b>How to set up DMARC safely<\/b><\/h2>\n<h3><b>Step 1: Configure SPF and DKIM<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">DMARC depends on their authentication results. Confirm that legitimate services pass SPF, DKIM or preferably both.<\/span><\/p>\n<h3><b>Step 2: Identify every sending source<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Include employee mail, support systems, CRM messages, marketing platforms, transactional mail and any service sending on behalf of the domain.<\/span><\/p>\n<h3><b>Step 3: Publish a monitoring record<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Start with:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><b>Step 4: Review the reports<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">DMARC aggregate reports reveal which sources use the domain and whether their messages pass authentication and alignment.<\/span><\/p>\n<h3><b>Step 5: Correct legitimate failures<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Update SPF, activate DKIM or adjust domain alignment for services that should be sending.<\/span><\/p>\n<h3><b>Step 6: Move toward enforcement<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">After confirming that legitimate traffic passes, consider progressing from:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">p=none<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">to:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">p=quarantine<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">and ultimately:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">p=reject<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">The time needed for monitoring depends on the size and complexity of the email environment. Do not use an arbitrary deadline if you have not identified all legitimate senders.<\/span><\/p>\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-large wp-image-51125\" src=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/4_4_11zon-1024x640.jpg\" alt=\"DMARC deployment cycle of observing reports, discovering senders, correcting failures, and strengthening enforcement.\" width=\"1024\" height=\"640\" srcset=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/4_4_11zon-1024x640.jpg 1024w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/4_4_11zon-300x188.jpg 300w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/4_4_11zon-768x480.jpg 768w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/4_4_11zon-1536x961.jpg 1536w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/4_4_11zon.jpg 1586w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\n<h2><b>Why SPF and DKIM are not enough without DMARC<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">SPF and DKIM return authentication results, but neither protocol alone requires alignment with the visible From domain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">An attacker could use one domain to pass SPF while placing a different domain in the visible From address. DKIM could also produce a valid signature from a domain unrelated to the address shown to the recipient.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">DMARC closes this gap by:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Checking alignment with the visible From domain<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Publishing a policy for failures<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Returning aggregate authentication reports<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Supporting enforcement against direct domain spoofing<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">DMARC does not stop every form of impersonation. It does not prevent attackers from registering a lookalike domain or using a different display name. It specifically addresses unauthorized use of the protected From domain.<\/span><\/p>\n<h2><b>The forwarding caveat<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Forwarding is one reason SPF and DKIM should be configured together.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When a server forwards an email, the new forwarding IP usually is not authorized in the original sender\u2019s SPF record. SPF may therefore fail.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">DKIM often survives because its signature remains attached to the message. If the forwarding service changes signed content, however, DKIM may also fail.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">DMARC may still pass after forwarding when DKIM passes and its signing domain aligns with the From domain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">That is why \u201cSPF fails during forwarding, but DKIM survives\u201d is a useful general rule rather than a guarantee.<\/span><\/p>\n<h2><b>Are SPF, DKIM and DMARC required in 2026?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">For high-volume senders, all three are explicit requirements at Gmail, Yahoo and Outlook.com. Requirements for lower-volume senders differ by provider.<\/span><\/p>\n<div style=\"width: 100%; overflow-x: auto; margin: 24px 0;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; border: 1px solid #d1d5db;\" border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<thead>\n<tr>\n<th style=\"width: 11%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Provider<\/th>\n<th style=\"width: 54%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Sender category<\/th>\n<th style=\"width: 35%; border: 1px solid #d1d5db; padding: 14px 16px; text-align: left; vertical-align: top;\">Authentication requirement<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\"><a href=\"https:\/\/support.google.com\/mail\/answer\/81126?hl=en\">Gmail<\/a><\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Senders below 5,000 messages per day to personal Gmail accounts<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">SPF or DKIM<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Gmail<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Senders of 5,000 or more messages per day to personal Gmail accounts<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">SPF, DKIM and DMARC with alignment<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\"><a href=\"https:\/\/senders.yahooinc.com\/best-practices\/\">Yahoo<\/a><\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Bulk senders<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">SPF, DKIM and a valid DMARC policy of at least p=none<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\"><a href=\"https:\/\/techcommunity.microsoft.com\/blog\/microsoftdefenderforoffice365blog\/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders\/4399730\">Outlook.com<\/a><\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">Domains sending more than 5,000 messages per day to Outlook.com consumer addresses<\/td>\n<td style=\"border: 1px solid #d1d5db; padding: 14px 16px; vertical-align: top;\">SPF, DKIM and DMARC<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span style=\"font-weight: 400;\">Google began applying its bulk-sender requirements in 2024. Microsoft announced its comparable Outlook.com requirements in April 2025 and began routing non-compliant high-volume mail to Junk after May 5, 2025, with rejection identified as a future enforcement step.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">These rules also cover requirements beyond authentication, including valid forward and reverse DNS, TLS, low spam complaint rates and one-click unsubscribe for applicable promotional or subscription mail.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Even if you send fewer than 5,000 messages per day, configuring SPF, DKIM and DMARC gives receiving systems consistent authentication signals and gives you visibility into unauthorized mail using your domain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Authentication is necessary, but it does not guarantee inbox placement. Your<\/span> <a href=\"https:\/\/woodpecker.co\/blog\/reputation-domain-ip\/\"><span style=\"font-weight: 400;\">domain reputation<\/span><\/a><span style=\"font-weight: 400;\">, complaint rate, bounce rate, recipient engagement and sending behavior still affect delivery.<\/span><\/p>\n<h2><b>SPF, DKIM and DMARC for cold email<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Every domain used for cold outreach should be authenticated before a campaign begins.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">A practical setup includes:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SPF authorizing the mailbox provider<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DKIM signing activated<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DMARC published initially in monitoring mode<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Valid MX records for receiving replies<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A real mailbox connected to the sending domain<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Gradual sending rather than an immediate volume spike<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Monitoring for authentication failures and reputation changes<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Authentication does not replace responsible sending. Respect the mailbox provider\u2019s<\/span><a href=\"https:\/\/woodpecker.co\/blog\/email-sending-limits\/\"> <span style=\"font-weight: 400;\">email sending limits<\/span><\/a><span style=\"font-weight: 400;\"> and introduce volume gradually on a new domain. A proper<\/span><a href=\"https:\/\/woodpecker.co\/blog\/domain-reputation\/\"> <span style=\"font-weight: 400;\">domain warm-up process<\/span><\/a><span style=\"font-weight: 400;\"> establishes normal mailbox activity before larger campaigns begin.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Many teams use a separate domain or related domain variation for outbound campaigns. If you take that approach, configure SPF, DKIM and DMARC separately for every active sending domain. Parent-domain records do not automatically cover every subdomain or separate domain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The full process for<\/span> <a href=\"https:\/\/woodpecker.co\/blog\/how-to-set-up-a-domain-and-mailbox-for-cold-outreach\/\"><span style=\"font-weight: 400;\">setting up a domain and mailbox for cold outreach<\/span><\/a><span style=\"font-weight: 400;\"> should be completed before prospects enter the campaign.<\/span><\/p>\n<h2><b>How to check your SPF, DKIM and DMARC setup<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">After publishing prospects the records, verify both their DNS presence and their real authentication results.<\/span><\/p>\n<h3><b>Check the DNS records<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Confirm that:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">One SPF record exists at the expected domain.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The DKIM selector resolves to the correct TXT or CNAME record.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A DMARC record exists at <\/span><span style=\"font-weight: 400;\">_dmarc.yourdomain.com<\/span><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Values do not contain accidental spaces or missing sections.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">DNS changes have propagated.<\/span><\/li>\n<\/ul>\n<h3><b>Send a test email<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Send a message to a mailbox where you can inspect the original headers.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Look for results such as:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">spf=pass<\/span><\/p>\n<p><span style=\"font-weight: 400;\">dkim=pass<\/span><\/p>\n<p><span style=\"font-weight: 400;\">dmarc=pass<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">A DNS record may exist but still fail during a real send because the sending platform uses an unauthorized source or an unaligned domain.<\/span><\/p>\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-large wp-image-51131\" src=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/5_5_11zon-1024x640.jpg\" alt=\"Two-stage authentication verification combining a DNS record check with a live email header test.\" width=\"1024\" height=\"640\" srcset=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/5_5_11zon-1024x640.jpg 1024w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/5_5_11zon-300x188.jpg 300w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/5_5_11zon-768x480.jpg 768w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/5_5_11zon-1536x961.jpg 1536w, https:\/\/woodpecker.co\/blog\/app\/uploads\/2026\/02\/5_5_11zon.jpg 1586w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/>\n<h3><b>Check every sending platform<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Test messages from:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Your normal employee mailbox<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">CRM or sales tools<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Customer support software<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Transactional email services<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Newsletter platforms<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Any other system using your domain<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">An<\/span> <a href=\"https:\/\/woodpecker.co\/blog\/email-deliverability-audit\/\"><span style=\"font-weight: 400;\">email deliverability audit<\/span><\/a><span style=\"font-weight: 400;\"> should examine authentication alongside reputation, content, sending volume and mailbox configuration.<\/span><\/p>\n<h2><b>Check your domain in Woodpecker<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Woodpecker users can review their connected domain from:<\/span><\/p>\n<p><b>Settings \u2192 Accounts \u2192 select the mailbox \u2192 Domain Check-Up<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The report checks your authentication configuration and highlights issues that need attention before a campaign begins.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Run the check after:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Connecting a new mailbox<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Changing DNS records<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Adding a sending service<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Moving to another email provider<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Rotating DKIM keys<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Creating a new outreach domain<\/span><\/li>\n<\/ul>\n<p><b>Run a<\/b> <a href=\"https:\/\/woodpecker.co\/help-center\/en\/articles\/5234530-what-is-a-domain-check-up\"><b>Woodpecker Domain Check-Up<\/b><\/a><b> before your next campaign and correct any failed authentication checks before sending.<\/b><\/p>\n<p>\n<aside class=\"cta-block cta-block--a-version js-cta-block ab-no-10-cta-block ab-no-11-cta-block\">\n  <p class=\"cta-block__heading u-heading-preset-md-600\">Send powerful emails &amp; boost replies<\/p>\n  <div class=\"cta-block__form-container\">\n    <form class=\"js-cta-block-form\" action=\"https:\/\/woodpecker.co\/signup\/\" class=\"cta-block__button-only-form js-cta-block-no-input-form\">\n      \n\n\n\n\n\n\n\n\n<button class=\"c-button js-button c-button--color-main c-button--size-small u-focus-visible-outline\">\nStart free trial\n<\/button>    <\/form>\n    \n    <form class=\"c-input-button-form js-cta-block-form cta-block__form\" action=\"https:\/\/woodpecker.co\/signup\/\" method=\"POST\" novalidate>\n        \n  <div class=\"c-form-field js-form-field  c-input-button-form__form-field\">\n    \n    <label class=\"c-label c-form-field__label\" for=\"cta-block-form-email-314032618\">Work email<\/label>\n\n                    \n  <input class=\"c-input  js-input c-input-button-form__input\" placeholder=\"will@woodpecker.co\" name=\"email\" id=\"cta-block-form-email-314032618\" type=\"email\" \/>\n            \n    <span class=\"c-form-field__error js-error\">\n                                      Invalid email format\n        \n\n                <\/span>\n  <\/div>\n\n        <div class=\"c-input-button-form__button\">\n          \n\n\n\n\n\n\n\n\n<button class=\"cta-block__button c-button js-button c-button--color-main c-button--size-small u-focus-visible-outline\">\n                Start free trial\n        \n\n<\/button>        <\/div>\n\n            <\/form>\n  <\/div>\n<\/aside><!-- notionvc: 2a232091-e38f-4f28-bf4a-cca0f36f6fa8 --><\/p>\n<h2><b>FAQ<\/b><\/h2>\n<h3><b>Do I need all three: SPF, DKIM and DMARC?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">High-volume senders need all three to meet the current Gmail, Yahoo and Outlook.com requirements. For lower-volume senders, requirements vary, but using all three provides more complete authentication, alignment, reporting and protection against direct domain spoofing.<\/span><\/p>\n<h3><b>What\u2019s the difference between SPF and DKIM?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">SPF checks whether the sending server is authorized in the envelope domain\u2019s DNS record. DKIM checks a cryptographic signature attached to the email. SPF is based on the sending source, while DKIM verifies the signing domain and signed message content.<\/span><\/p>\n<h3><b>Are SPF, DKIM and DMARC required in 2026?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">All three are required for high-volume senders delivering to personal Gmail, Yahoo and Outlook.com addresses. Gmail defines a bulk sender as one sending at least 5,000 messages per day to personal Gmail accounts. Microsoft applies its rule to domains sending more than 5,000 messages per day to Outlook.com consumer addresses. Lower-volume rules vary, but complete authentication remains strongly recommended.<\/span><\/p>\n<h3><b>Does DMARC require SPF and DKIM to pass?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">No. DMARC passes when either SPF or DKIM passes and the authenticated domain aligns with the visible From domain. Having both configured provides a fallback if one method fails.<\/span><\/p>\n<h3><b>Can I publish multiple SPF records?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">No. Publish one SPF record per domain. Combine the authorized sending services within that record. Multiple SPF records cause a permanent SPF evaluation error.<\/span><\/p>\n<h3><b>What DMARC policy should I start with?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Start with <\/span><span style=\"font-weight: 400;\">p=none<\/span><span style=\"font-weight: 400;\"> to collect reports and identify legitimate sending sources without requesting that failed messages be blocked. After resolving legitimate failures, move gradually toward <\/span><span style=\"font-weight: 400;\">p=quarantine<\/span><span style=\"font-weight: 400;\"> and <\/span><span style=\"font-weight: 400;\">p=reject<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h3><b>How do I know whether DKIM is working?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Send a test email and inspect the original message headers for <\/span><span style=\"font-weight: 400;\">dkim=pass<\/span><span style=\"font-weight: 400;\">. You should also confirm that the selector in the message resolves to the correct DNS record.<\/span><\/p>\n<h3><b>Does SPF survive email forwarding?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Usually not. Forwarding changes the sending server, and that server may not appear in the original domain\u2019s SPF record. DKIM may survive if the forwarding process does not alter signed parts of the message.<\/span><\/p>\n<h3><b>Does setting up SPF, DKIM and DMARC guarantee inbox placement?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">No. Authentication is a prerequisite for trustworthy sending, not a guarantee of inbox placement. Domain reputation, list quality, complaints, bounces, message content and sending behavior also influence delivery.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is serious. This is about your email deliverability. I know from my own experience that these acronyms may sound unfamiliar, scary and may seem totally uninteresting. Or maybe they sound familiar, but you never cared enough to check what they really are. Either way, it&#8217;s time to learn a bit about what SPF, DKIM and DMARC are and how to set them up in your DNS records for your mail server, if you want to have better control over your email deliverability.<\/p>\n","protected":false},"author":17,"featured_media":9215,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[13],"tags":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What Is SPF, DKIM &amp; DMARC? (+ How to Set Them Up in 2026)<\/title>\n<meta name=\"description\" content=\"Learn how to set up SPF, DKIM and DMARC in 2026. Step-by-step guide for every major email provider, plus a quick-check table.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is SPF, DKIM &amp; DMARC? (+ How to Set Them Up in 2026)\" \/>\n<meta property=\"og:description\" content=\"Learn how to set up SPF, DKIM and DMARC in 2026. Step-by-step guide for every major email provider, plus a quick-check table.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\" \/>\n<meta property=\"og:site_name\" content=\"Woodpecker Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/business.facebook.com\/woodpeckerapp\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-24T11:27:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-03T12:09:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2020\/07\/What_is_DKIM__SPF_And_How_to_Set_It_Up__2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"650\" \/>\n\t<meta property=\"og:image:height\" content=\"391\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Margaret Sikora\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@woodpeckerapp\" \/>\n<meta name=\"twitter:site\" content=\"@woodpeckerapp\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/woodpecker.co\/blog\/spf-dkim\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\"},\"author\":{\"name\":\"Margaret Sikora\",\"@id\":\"https:\/\/woodpecker.co\/blog\/#\/schema\/person\/dbd5fae1eeb41a0caf2e2c7bda48059f\"},\"headline\":\"What Is SPF, DKIM &#038; DMARC? (+ How to Set Them Up in 2026)\",\"datePublished\":\"2026-02-24T11:27:03+00:00\",\"dateModified\":\"2026-08-03T12:09:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\"},\"wordCount\":3516,\"commentCount\":11,\"publisher\":{\"@id\":\"https:\/\/woodpecker.co\/blog\/#organization\"},\"articleSection\":[\"Deliverability\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/woodpecker.co\/blog\/spf-dkim\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\",\"url\":\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\",\"name\":\"What Is SPF, DKIM & DMARC? (+ How to Set Them Up in 2026)\",\"isPartOf\":{\"@id\":\"https:\/\/woodpecker.co\/blog\/#website\"},\"datePublished\":\"2026-02-24T11:27:03+00:00\",\"dateModified\":\"2026-08-03T12:09:55+00:00\",\"description\":\"Learn how to set up SPF, DKIM and DMARC in 2026. Step-by-step guide for every major email provider, plus a quick-check table.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/woodpecker.co\/blog\/spf-dkim\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/woodpecker.co\/blog\/#website\",\"url\":\"https:\/\/woodpecker.co\/blog\/\",\"name\":\"Woodpecker Blog\",\"description\":\"Woodpecker Blog - Pro Tips on Cold Emails, Follow-ups, Sales &amp; Growth\",\"publisher\":{\"@id\":\"https:\/\/woodpecker.co\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/woodpecker.co\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/woodpecker.co\/blog\/#organization\",\"name\":\"Woodpecker.co\",\"url\":\"https:\/\/woodpecker.co\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/woodpecker.co\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2015\/06\/WP_Logo_WersjaPodstawowa_Pionowa_CzarneTlo_RGB.jpg\",\"contentUrl\":\"https:\/\/woodpecker.co\/blog\/app\/uploads\/2015\/06\/WP_Logo_WersjaPodstawowa_Pionowa_CzarneTlo_RGB.jpg\",\"width\":1240,\"height\":874,\"caption\":\"Woodpecker.co\"},\"image\":{\"@id\":\"https:\/\/woodpecker.co\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/business.facebook.com\/woodpeckerapp\",\"https:\/\/twitter.com\/woodpeckerapp\",\"https:\/\/www.instagram.com\/woodpeckerapp\/\",\"https:\/\/www.linkedin.com\/company\/woodpecker-co\/\",\"https:\/\/www.youtube.com\/channel\/UCNN9wM55yaNI-KEZCfh66_A\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/woodpecker.co\/blog\/#\/schema\/person\/dbd5fae1eeb41a0caf2e2c7bda48059f\",\"name\":\"Margaret Sikora\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/woodpecker.co\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/285df23338966e859f136eed9706c0a6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/285df23338966e859f136eed9706c0a6?s=96&d=mm&r=g\",\"caption\":\"Margaret Sikora\"},\"description\":\"Product Manager and DPO at Woodpecker. A lawyer who gets the SaaS business, understands customers' needs, and speaks the language of IT guys.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/margaretsikora\/\",\"https:\/\/www.instagram.com\/margaret.sikora.official\"],\"url\":\"https:\/\/woodpecker.co\/blog\/author\/gosia-sikora\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is SPF, DKIM & DMARC? (+ How to Set Them Up in 2026)","description":"Learn how to set up SPF, DKIM and DMARC in 2026. Step-by-step guide for every major email provider, plus a quick-check table.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/woodpecker.co\/blog\/spf-dkim\/","og_locale":"en_US","og_type":"article","og_title":"What Is SPF, DKIM & DMARC? (+ How to Set Them Up in 2026)","og_description":"Learn how to set up SPF, DKIM and DMARC in 2026. Step-by-step guide for every major email provider, plus a quick-check table.","og_url":"https:\/\/woodpecker.co\/blog\/spf-dkim\/","og_site_name":"Woodpecker Blog","article_publisher":"https:\/\/business.facebook.com\/woodpeckerapp","article_published_time":"2026-02-24T11:27:03+00:00","article_modified_time":"2026-08-03T12:09:55+00:00","og_image":[{"width":650,"height":391,"url":"https:\/\/woodpecker.co\/blog\/app\/uploads\/2020\/07\/What_is_DKIM__SPF_And_How_to_Set_It_Up__2.png","type":"image\/png"}],"author":"Margaret Sikora","twitter_card":"summary_large_image","twitter_creator":"@woodpeckerapp","twitter_site":"@woodpeckerapp","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/woodpecker.co\/blog\/spf-dkim\/#article","isPartOf":{"@id":"https:\/\/woodpecker.co\/blog\/spf-dkim\/"},"author":{"name":"Margaret Sikora","@id":"https:\/\/woodpecker.co\/blog\/#\/schema\/person\/dbd5fae1eeb41a0caf2e2c7bda48059f"},"headline":"What Is SPF, DKIM &#038; DMARC? (+ How to Set Them Up in 2026)","datePublished":"2026-02-24T11:27:03+00:00","dateModified":"2026-08-03T12:09:55+00:00","mainEntityOfPage":{"@id":"https:\/\/woodpecker.co\/blog\/spf-dkim\/"},"wordCount":3516,"commentCount":11,"publisher":{"@id":"https:\/\/woodpecker.co\/blog\/#organization"},"articleSection":["Deliverability"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/woodpecker.co\/blog\/spf-dkim\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/woodpecker.co\/blog\/spf-dkim\/","url":"https:\/\/woodpecker.co\/blog\/spf-dkim\/","name":"What Is SPF, DKIM & DMARC? (+ How to Set Them Up in 2026)","isPartOf":{"@id":"https:\/\/woodpecker.co\/blog\/#website"},"datePublished":"2026-02-24T11:27:03+00:00","dateModified":"2026-08-03T12:09:55+00:00","description":"Learn how to set up SPF, DKIM and DMARC in 2026. Step-by-step guide for every major email provider, plus a quick-check table.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/woodpecker.co\/blog\/spf-dkim\/"]}]},{"@type":"WebSite","@id":"https:\/\/woodpecker.co\/blog\/#website","url":"https:\/\/woodpecker.co\/blog\/","name":"Woodpecker Blog","description":"Woodpecker Blog - Pro Tips on Cold Emails, Follow-ups, Sales &amp; Growth","publisher":{"@id":"https:\/\/woodpecker.co\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/woodpecker.co\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/woodpecker.co\/blog\/#organization","name":"Woodpecker.co","url":"https:\/\/woodpecker.co\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/woodpecker.co\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/woodpecker.co\/blog\/app\/uploads\/2015\/06\/WP_Logo_WersjaPodstawowa_Pionowa_CzarneTlo_RGB.jpg","contentUrl":"https:\/\/woodpecker.co\/blog\/app\/uploads\/2015\/06\/WP_Logo_WersjaPodstawowa_Pionowa_CzarneTlo_RGB.jpg","width":1240,"height":874,"caption":"Woodpecker.co"},"image":{"@id":"https:\/\/woodpecker.co\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/business.facebook.com\/woodpeckerapp","https:\/\/twitter.com\/woodpeckerapp","https:\/\/www.instagram.com\/woodpeckerapp\/","https:\/\/www.linkedin.com\/company\/woodpecker-co\/","https:\/\/www.youtube.com\/channel\/UCNN9wM55yaNI-KEZCfh66_A"]},{"@type":"Person","@id":"https:\/\/woodpecker.co\/blog\/#\/schema\/person\/dbd5fae1eeb41a0caf2e2c7bda48059f","name":"Margaret Sikora","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/woodpecker.co\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/285df23338966e859f136eed9706c0a6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/285df23338966e859f136eed9706c0a6?s=96&d=mm&r=g","caption":"Margaret Sikora"},"description":"Product Manager and DPO at Woodpecker. A lawyer who gets the SaaS business, understands customers' needs, and speaks the language of IT guys.","sameAs":["https:\/\/www.linkedin.com\/in\/margaretsikora\/","https:\/\/www.instagram.com\/margaret.sikora.official"],"url":"https:\/\/woodpecker.co\/blog\/author\/gosia-sikora\/"}]}},"_links":{"self":[{"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/posts\/2133"}],"collection":[{"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/comments?post=2133"}],"version-history":[{"count":39,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/posts\/2133\/revisions"}],"predecessor-version":[{"id":51143,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/posts\/2133\/revisions\/51143"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/media\/9215"}],"wp:attachment":[{"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/media?parent=2133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/categories?post=2133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/woodpecker.co\/blog\/wp-json\/wp\/v2\/tags?post=2133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}