If you’ve ever sent an email that ended up in the spam folder, or seen a sketchy email pretending to be from a brand you trust, you’ve run into what happens when email authentication isn’t set up correctly. SPF and DKIM are two simple records you can add to your domain to fix many of those problems. A surprising number of businesses still don’t have them in place, and it’s costing them.
Here’s what they do and why you should set them up sooner rather than later.
The Problem with Email
Email was built back in the 1980s when the internet was a small, friendly place. The folks who designed it figured everyone would be honest about who they were. That assumption hasn’t held up. These days, anyone can send an email claiming to be from your company, and the email system itself doesn’t verify that it’s really you.
That’s where SPF and DKIM come in. They’re records you add to your domain that tell the rest of the internet, “Here’s how to know an email is actually from me.”
SPF: The Guest List
SPF stands for Sender Policy Framework. Think of it as a guest list for your domain. It tells email servers which services are allowed to send email on your behalf, like Google Workspace, Microsoft 365, or whatever email tool you use.
When an email shows up claiming to be from your domain, the receiving server checks the guest list. If the sender isn’t on it, the email gets flagged or thrown out.
A basic SPF record looks like this:
That one line tells the world, “Email from my domain should only come from Google. Anything else is suspicious.”
DKIM: The Tamper-Proof Seal
DKIM stands for DomainKeys Identified Mail. Instead of a guest list, it works like a tamper-proof seal. Your email server signs every message you send with a secret key, and the matching public key sits in your domain records.
When the email lands in someone’s inbox, their server checks the seal. It tells them two things:
- The email really did come from your domain.
- Nobody messed with the email along the way.
If even one character in the message is changed, the seal breaks and the email is flagged.
Why You Need Both
SPF checks who sent the email. DKIM checks the email itself. Each one has gaps, and using them together covers those gaps.
SPF can break when emails get forwarded, because the forwarding server isn’t on your guest list. DKIM doesn’t say anything about whether the sending server is authorized to send on your behalf. Put them together, and it gets a lot harder for anyone to fake emails from your domain.
What Happens If You Skip This
A few things, and none of them are good.
First, your real emails start landing in spam folders. Gmail, Outlook, and Yahoo are getting stricter about filtering unauthenticated email. As of 2024, Google and Yahoo actually require SPF and DKIM if you send a lot of email.
Second, scammers can pretend to be you. Without these records in place, anyone can send phishing emails that look like they’re from your business. That hurts your reputation and can cost your customers real money.
Third, you have no idea what’s going on. With SPF, DKIM, and DMARC layered on top, you get reports about who’s sending email using your domain. Without them, you’re flying blind.
The Bottom Line
Setting up SPF and DKIM takes about 15 minutes for most email providers. Google Workspace, Microsoft 365, and the major email marketing tools all provide the exact records to add to your domain settings.
It’s one of the easiest wins you can get for both deliverability and security. If you’ve been putting it off, today’s a good day to knock it out.
Once you’ve got SPF and DKIM in place, the next step is DMARC. It ties everything together and tells email servers what to do when something doesn’t pass the check. We’ll save that for another post.
