DKIM, SPF, and DMARC explained (in plain English)
A jargon-free explanation of the three email authentication records, DKIM, SPF, and DMARC, what each one does, and why they decide whether you reach the inbox.
If you’ve set up email sending, you’ve seen three acronyms: DKIM, SPF, and DMARC. They sound scary, but the idea behind each is simple. Here’s what they actually do, no tech background needed.
The problem they solve
Email was invented without any way to prove who really sent a message. Anyone could pretend to be anyone. DKIM, SPF, and DMARC are the three checks that prove an email genuinely came from you, so inbox providers trust it instead of filtering it.
Think of sending an email like sending a letter:
SPF: the approved senders list
SPF says “these are the post offices allowed to send mail for me.” It lists which servers are permitted to send email from your domain. When an email arrives, the receiver checks: did this come from an approved sender? If not, it’s suspicious.
In short: SPF proves the email came from a server you authorized.
DKIM: the tamper-proof seal
DKIM adds an invisible digital signature to each email, like a wax seal on a letter. The receiver checks the seal to confirm two things: the email really came from your domain, and nobody altered it along the way.
In short: DKIM proves the email is genuinely yours and wasn’t tampered with.
DMARC: the instructions
DMARC ties the first two together and tells receivers what to do if a message fails the checks: ignore it, send it to spam, or reject it outright. It also lets you get reports on who’s sending email using your name.
In short: DMARC sets the policy and catches impersonators.
Why you need all three
Each covers a different angle. Together they tell Gmail, Outlook, and the rest: “this sender is the real deal.” That’s why authenticated email lands in the inbox and unauthenticated email gets filtered, or rejected.
Modern providers like Gmail and Yahoo now require authentication for anyone sending in volume. It’s no longer optional.
How to set them up
You don’t configure these by hand. TinyCourier generates the exact records for you, you just paste them into your domain once. We walk through it step by step here:
DKIM and SPF are required; DMARC is optional but strongly recommended. Set them once and you’re done for good.