# Understanding SPF, DKIM, and DMARC

## Why this matters

SPF, DKIM, and DMARC are the three standards that prove your emails are really from you. Inbox providers use them to decide whether to deliver your message, send it to spam, or reject it. You don't need to be an expert, but a basic understanding helps you set things up correctly and troubleshoot when something goes wrong.

This page explains the concepts. For the actual setup steps, see [Authenticating your domain](/en/docs/senders/authenticating-domains).

## SPF (Sender Policy Framework)

SPF lists which mail servers are allowed to send email for your domain. When a provider receives your message, it checks that it came from an approved server.

When you send through our platform, SPF is handled for you by our sending infrastructure, so there is no SPF record for you to add. (Aligning your bounce domain, described in [Tracking and bounce domains](/en/docs/senders/tracking-and-bounce-domains), is what ties this to your own domain.)

## DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to every email you send. The receiving provider uses it to confirm two things: that the message really came from your domain, and that it wasn't changed in transit.

This is the record **you add** to your DNS when you authenticate your domain. We generate it for you as a `TXT` record.

## DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties SPF and DKIM together and lets **you**, the domain owner, decide what a provider should do with email that fails authentication. It also lets you receive reports about who is sending email using your domain.

A DMARC record is published as a `TXT` record named `_dmarc.yourdomain.com`. If you don't have one yet, start with this value:

```
v=DMARC1; p=none;
```

### DMARC policy levels

The `p=` part is your policy. You can tighten it over time as you gain confidence:

- `p=none` - monitor only; nothing is blocked. Start here.
- `p=quarantine` - failing email is sent to spam.
- `p=reject` - failing email is rejected outright.

Begin with `p=none`, review your reports, and move to stricter policies once you're sure all your legitimate email passes.

## How this works on our platform

- **You add** the DKIM record we generate.
- **We verify** your DKIM and DMARC records during authentication.
- **SPF** is handled for you by our sending infrastructure.

## Related articles

- [Authenticating your domain](/en/docs/senders/authenticating-domains) - Set up DKIM and DMARC
- [Tracking and bounce domains](/en/docs/senders/tracking-and-bounce-domains) - Align your domain
- [Meeting Gmail and Yahoo sender requirements](/en/docs/delivery-troubleshooting/gmail-yahoo-sender-requirements) - Why this is required
- [Adding DNS records at your hosting provider](/en/docs/senders/adding-dns-records) - Where to add records