Why they exist
Email was designed with no way to prove who sent a message: anyone can write any address in the From line. SPF, DKIM and DMARC were added on top, each answering one question. Large mailbox providers, including Gmail and Yahoo, now require them from bulk senders, and treat unauthenticated mail with more suspicion.
SPF: who may send
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send mail for a domain. The receiver checks the server that delivered the message against that list.
An SPF record for a domain that sends through Resend
v=spf1 include:amazonses.com ~allinclude:adds another service’s list. Each provider tells you its own.~allmeans “anything else is suspicious”;-allmeans “anything else fails”.- Only one SPF record per host. Merge services into one line.
- SPF allows at most 10 DNS lookups. Every
includecounts, and the ones it includes count too, so long chains break quietly. - SPF checks the return-path domain, not the From address people see. That is why DMARC is needed.
DKIM: was it changed
DKIM (DomainKeys Identified Mail) signs each message. Your provider holds a private key and adds a signature header; you publish the public key in DNS at a selector, such as resend._domainkey.example.com. The receiver fetches the key and checks that the signed parts of the message were not changed and that the signing domain is the one named.
Each sending service has its own selector, so several can coexist. DKIM survives forwarding better than SPF, because the signature travels with the message.
DMARC: what to do when checks fail
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two to the address people actually see. A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the From domain. This matching is called alignment.
A DMARC record that only reports
v=DMARC1; p=none; rua=mailto:dmarc@example.com| Policy | What receivers do with failing mail | When to use it |
|---|---|---|
p=none | Deliver as normal, and report | At the start, while you find every service that sends for you |
p=quarantine | Treat as suspicious, usually spam | Once reports show your real mail passing |
p=reject | Refuse it | When you are sure, for the strongest protection against spoofing |
The rua address receives daily aggregate reports from large providers: which servers sent mail as your domain and whether it passed. They are XML and arrive daily, so it helps to file them automatically; Nexmail puts them under their own label, marked read, and keeps them out of Slack.
How they work together
- Your message arrives. The receiver checks SPF against the return-path domain.
- It checks the DKIM signature against the key at your selector.
- It looks up your DMARC record and asks: did either pass, for a domain that matches the From address?
- If yes, DMARC passes. If no, it applies your policy and records the result in its report to you.
Common mistakes
- Two SPF records on the same host, so both fail.
- A DKIM key pasted with a line break or cut short.
- Jumping straight to
p=rejectand blocking a service you forgot sends for you, such as invoicing or a newsletter tool. - Never reading the reports, so a problem is only noticed when customers stop getting mail.
Nexmail checks SPF, DKIM and DMARC for your sending domain before a send and warns when one is missing or failing. It never blocks a send for them, because a record that has not spread yet should not hold up a reply to a customer.
How to set it up
- Add your domain. Sign up, open Get started and add your domain. Nexmail lists the SPF, DKIM and DMARC records your provider needs.
- Publish them. Let Nexmail publish them with a Cloudflare, Vercel or DigitalOcean token, or add them by hand at your DNS host.
- Check them. Click Check DNS. Each record is looked up through public resolvers.
- Start DMARC at p=none. Read the reports for a few weeks, then move to
p=quarantineand laterp=reject.
Questions
Do I need all three?
Yes, in practice. SPF and DKIM prove a message is genuine in different ways, and DMARC is what ties them to the address people see and tells receivers what to do. Large providers expect all three from anyone who sends in volume.
What does DMARC p=none do?
Nothing to your mail: receivers deliver it as usual and send you reports. It is the safe way to start and learn which services send as your domain.
Why does my mail fail DMARC when SPF passes?
Usually alignment. SPF passed for your provider’s return-path domain, not for your From domain. A DKIM signature from your own domain fixes it, which is why DKIM matters most.
Can I have more than one DKIM record?
Yes. Each service uses its own selector, such as resend._domainkey and mail._domainkey, so they do not clash.
Read next
- How to set up email on your own domain — Step by step: set up email on a domain you own. The MX, SPF, DKIM and DMARC records, where to add them, and how to check that mail arrives and sends.
- Connect your domain to Nexmail — The DNS records Nexmail needs to send and receive email at your domain through Resend, what each one does, how to find your DNS host, and the common mistakes that stop a domain verifying.
- Email for startups: a practical setup guide — A practical email setup for a new startup: which addresses to create, how to authenticate your domain, where replies should land and what it costs.