To learn how to use spf records to check whether an email you received is legitimate click here
For the standard version read below.
For those that want an even easier version that anyone can understand click here
SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are email security records that help prove your emails are genuine and have not been tampered with. They are published in your domain's DNS settings and are checked by receiving mail servers whenever you send an email.
Without these records, your emails are more likely to be marked as spam, rejected, or used by scammers pretending to send email from your domain.
SPF is a DNS record that lists the mail servers authorised to send email on behalf of your domain.
When you send an email, the receiving mail server checks your domain's SPF record to see whether the sending server is authorised. If it is, the SPF check passes. If it is not, the email may be treated as suspicious.
Example:
A scammer attempts to send an email using your email address.
Although they can place your address in the "From" field, they are sending from an unauthorised server. When the recipient's mail server checks your SPF record, it sees that the scammer's server is not approved and can reject the email or move it to spam.
DKIM works differently. Instead of authorising servers, it digitally signs outgoing emails.
When a message leaves your mail server, a unique cryptographic signature is added to the email header. The receiving mail server uses the DKIM record published in your DNS to verify that:
If the signature cannot be verified, the email may be treated as suspicious.
SPF and DKIM provide several important benefits:
Most major email providers, including Microsoft 365, Google Workspace, Outlook.com and Gmail, expect domains to have SPF and DKIM configured correctly.
Identify every service that sends email using your domain, such as:
Log in to your DNS management panel.
Create or edit your SPF TXT record.
A Microsoft 365 SPF record typically looks similar to:
If you use additional services, their authorised servers must also be included.
For Microsoft 365, DKIM is usually enabled in the Microsoft Defender or Exchange administration settings after the required DNS records have been added.
Suppose you run a business and use QuickBooks to email invoices.
Without updating your SPF record, an invoice sent from QuickBooks may fail authentication because QuickBooks' servers are not listed as authorised senders for your domain.
By adding the QuickBooks SPF entry to your DNS records and enabling DKIM where available, recipient mail servers can verify that QuickBooks is authorised to send on your behalf, improving the chances that invoices are delivered successfully.
There are two simple ways to verify that SPF and DKIM are working correctly.
Send a test email from your domain to a Gmail, Outlook, or other mailbox you can access.
Open the received email and view the message headers. You should look for lines similar to:
If you see SPF=pass and DKIM=pass, the authentication checks have succeeded and are working correctly.
For example:
This means:
You can verify that the records exist by using online DNS lookup tools.
For SPF:
yourdomain.com
and should return a valid DKIM record.
SPF Problems
DKIM Problems
The best real-world test is:
If all three pass, your email authentication is generally configured correctly.
To learn how to use spf records to check whether an email you received is legitimate click here
For the standard version read below.
For those that want an even easier version that anyone can understand click here
SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are email security records that help prove your emails are genuine and have not been tampered with. They are published in your domain's DNS settings and are checked by receiving mail servers whenever you send an email.
Without these records, your emails are more likely to be marked as spam, rejected, or used by scammers pretending to send email from your domain.
SPF is a DNS record that lists the mail servers authorised to send email on behalf of your domain.
When you send an email, the receiving mail server checks your domain's SPF record to see whether the sending server is authorised. If it is, the SPF check passes. If it is not, the email may be treated as suspicious.
Example:
A scammer attempts to send an email using your email address.
Although they can place your address in the "From" field, they are sending from an unauthorised server. When the recipient's mail server checks your SPF record, it sees that the scammer's server is not approved and can reject the email or move it to spam.
DKIM works differently. Instead of authorising servers, it digitally signs outgoing emails.
When a message leaves your mail server, a unique cryptographic signature is added to the email header. The receiving mail server uses the DKIM record published in your DNS to verify that:
If the signature cannot be verified, the email may be treated as suspicious.
SPF and DKIM provide several important benefits:
Most major email providers, including Microsoft 365, Google Workspace, Outlook.com and Gmail, expect domains to have SPF and DKIM configured correctly.
Identify every service that sends email using your domain, such as:
Log in to your DNS management panel.
Create or edit your SPF TXT record.
A Microsoft 365 SPF record typically looks similar to:
If you use additional services, their authorised servers must also be included.
For Microsoft 365, DKIM is usually enabled in the Microsoft Defender or Exchange administration settings after the required DNS records have been added.
Suppose you run a business and use QuickBooks to email invoices.
Without updating your SPF record, an invoice sent from QuickBooks may fail authentication because QuickBooks' servers are not listed as authorised senders for your domain.
By adding the QuickBooks SPF entry to your DNS records and enabling DKIM where available, recipient mail servers can verify that QuickBooks is authorised to send on your behalf, improving the chances that invoices are delivered successfully.
There are two simple ways to verify that SPF and DKIM are working correctly.
Send a test email from your domain to a Gmail, Outlook, or other mailbox you can access.
Open the received email and view the message headers. You should look for lines similar to:
If you see SPF=pass and DKIM=pass, the authentication checks have succeeded and are working correctly.
For example:
This means:
You can verify that the records exist by using online DNS lookup tools.
For SPF:
yourdomain.com
and should return a valid DKIM record.
SPF Problems
DKIM Problems
The best real-world test is:
If all three pass, your email authentication is generally configured correctly.