What are MX, SPF, DKIM and DMARC?
The four records that decide where your mail goes, and whether it's trusted.
Short answer
MX tells the world which server mail sent TO your domain should be delivered to. The other three handle the opposite direction — proving that mail sent FROM your domain is genuine: SPF lists who may send on your behalf, DKIM signs each message cryptographically, and DMARC tells receivers what to do when the first two fail. MX is what lets you receive mail; the other three are what make your mail trusted.
MX: where incoming mail is delivered
When someone writes to you@company.com, their server asks DNS: "where does mail for company.com go?". The MX record is the answer. It points at the hostname of a mail server, with a priority number — LOWER numbers are tried first, which is how backup servers work.
Set it wrong and: you receive no mail at all, or mail keeps going to your old provider. It is the only one of the four where a mistake loses you mail immediately.
SPF: who may send on your behalf
SPF is a line of text published in DNS listing the systems allowed to send mail carrying your domain. The receiver checks whether this message came from a server on that list. If your company sends from several places — the email service, a sales tool, a website form — then ALL of them have to appear in that line.
Set it wrong and: mail goes to spam, or is rejected outright. The most common mistake is having TWO SPF lines for one domain — the standard allows only one, and two break both.
DKIM: a signature on each message
SPF only checks WHERE a message came from, not whether its contents were altered in transit. DKIM covers that: the sending server adds a cryptographic signature and publishes the public key in DNS for receivers to check against. A match means the message really did come from your domain and wasn't modified after sending.
Set it wrong and: mail loses trust even when SPF passes. DKIM is also what preserves authentication when a message is forwarded — the case where SPF almost always fails.
DMARC: what to do when checks fail
SPF and DKIM produce a pass or a fail, but by themselves they don't tell the receiver what to do about a failure. DMARC is the policy you publish: ignore, send to spam, or reject outright. It also gets you reports — who is sending mail in your domain's name, and whether it passes.
Set it wrong and: either you protect nothing (policy left at ignore and forgotten), or you block your own genuine mail (jumping straight to reject while some system is still undeclared). Tighten gradually, and read the reports before raising the level.
The order to add them
- MX first — so you start receiving mail.
- SPF and DKIM next — so the mail you send is trusted.
- DMARC last, starting at a gentle level. Only tighten once the reports show every genuine sending source of yours is passing.
How to check it's right
Send a message to any Gmail account, open it and choose "Show original". The top of the page shows three lines — SPF, DKIM and DMARC — and all three should read PASS. This is a faster and more trustworthy check than most online tools, because it tells you how a real receiving system actually judged your message.