--- title: SPF, DKIM, and DMARC explained for developers | daily.dev description: Transactional email landing in spam is almost always caused by missing SPF, DKIM, or DMARC DNS records. SPF lists authorized sending IPs via a TXT record, with... canonical: https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SPF, DKIM, and DMARC explained for developers | daily.dev og:description: Transactional email landing in spam is almost always caused by missing SPF, DKIM, or DMARC DNS records. SPF lists authorized sending IPs via a TXT record, with... og:url: https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg og:image: https://api.daily.dev/og/posts/mBs1NoOVg.png og:image:alt: SPF, DKIM, and DMARC explained for developers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SPF, DKIM, and DMARC explained for developers **[Flavio Copes](https://daily.dev/sources/flaviocopes)** · 6 min read · 2 upvotes · 1 comments ## Summary Transactional email landing in spam is almost always caused by missing SPF, DKIM, or DMARC DNS records. SPF lists authorized sending IPs via a TXT record, with key pitfalls being duplicate records and the 10-lookup limit. DKIM uses cryptographic signing to prove message integrity, with the public key published at a selector-based DNS path. DMARC adds alignment — requiring SPF or DKIM to match the visible From header — and a policy (none/quarantine/reject) for failures, plus aggregate reporting. The recommended rollout is SPF+DKIM first, then DMARC at p=none for 2–4 weeks of monitoring, then gradual escalation to quarantine and finally reject. DNS records can be inspected with dig, and the author provides a tool to generate all three records for common providers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the ~all versus -all qualifier mean in an SPF record? The qualifier at the end of an SPF record determines what happens to mail from IPs not listed as authorized senders. ~all means soft fail, marking such mail as suspicious but still allowing delivery, while -all means hard fail, causing it to be rejected outright. The recommended approach is to start with ~all while verifying the record is complete, then switch to -all once confident. _daily.dev surfaces DNS and deliverability guidance for teams tightening down their SPF policy._ ### Why does adding multiple email providers break my SPF record? SPF records allow a maximum of 10 DNS lookups, and each include: directive costs at least one lookup, with nested includes adding more. Stacking enough providers silently breaks SPF with a permerror. Also, having two separate TXT records that both start with v=spf1 is an error that causes SPF to fail entirely; a second provider must be merged into the existing single record instead. _daily.dev helps developers troubleshoot email deliverability issues like SPF lookup limits before they hit production._ ### What is the safe rollout order for enabling DMARC without blocking legitimate email? Set up SPF and DKIM first and confirm both pass, then publish DMARC with p=none and a rua reporting address so nothing changes for delivery while aggregate reports reveal every legitimate sender that might otherwise get blocked. After watching reports for two to four weeks, move to p=quarantine starting at pct=25 and ramping to 100, then switch to p=reject once reports are clean. _daily.dev keeps developers on top of DMARC rollout steps so a policy change doesn't quietly block real mail._ ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 0 upvotes > DMARC reports belong in a service, not a mailbox. Nobody wants compressed XML during a delivery incident. ## Similar posts on daily.dev - [SPF Alignment: Why is it Important for Improving DMARC](https://daily.dev/posts/spf-alignment-why-is-it-important-for-improving-dmarc-voyvelyv6) · Security Boulevard · 0 upvotes · 0 comments - [Relaying outbound mail: DKIM, client IPs, and visibility](https://daily.dev/posts/relaying-outbound-mail-dkim-client-ips-and-visibility-lm5r3yjpy) · /dev/io · 0 upvotes · 0 comments - [What DMARC Actually Protects You From, and What It Does Not](https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj) · Hacker News · 0 upvotes · 0 comments - [Email is crazy](https://daily.dev/posts/email-is-crazy-y6xb4vf9s) · Lobsters · 0 upvotes · 0 comments - [Cloudflare DMARC Management is now generally available](https://daily.dev/posts/cloudflare-dmarc-management-is-now-generally-available-iafjsukql) · Cloudflare · 7 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SPF, DKIM, and DMARC explained for developers","url":"https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg"},"datePublished":"2026-08-08T06:04:52.350Z","dateModified":"2026-09-14T06:29:19.584Z","description":"Transactional email landing in spam is almost always caused by missing SPF, DKIM, or DMARC DNS records. SPF lists authorized sending IPs via a TXT record, with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7219243bb6b6113ecc90bd933965a4ef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7219243bb6b6113ecc90bd933965a4ef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Flavio Copes","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Flavio Copes","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1f2dbd275797411bbd37bfdaaf0951a9","url":"https://daily.dev/sources/flaviocopes"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,dns","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Flavio Copes","item":"https://daily.dev/sources/flaviocopes"},{"@type":"ListItem","position":3,"name":"SPF, DKIM, and DMARC explained for developers"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg","comment":[{"@type":"Comment","text":"DMARC reports belong in a service, not a mailbox. Nobody wants compressed XML during a delivery incident.","datePublished":"2026-08-08T19:38:59.336Z","url":"https://daily.dev/posts/mBs1NoOVg#c-xQ6rgRG1l","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg#faq","mainEntity":[{"@type":"Question","name":"What does the ~all versus -all qualifier mean in an SPF record?","acceptedAnswer":{"@type":"Answer","text":"The qualifier at the end of an SPF record determines what happens to mail from IPs not listed as authorized senders. ~all means soft fail, marking such mail as suspicious but still allowing delivery, while -all means hard fail, causing it to be rejected outright. The recommended approach is to start with ~all while verifying the record is complete, then switch to -all once confident. daily.dev surfaces DNS and deliverability guidance for teams tightening down their SPF policy."}},{"@type":"Question","name":"Why does adding multiple email providers break my SPF record?","acceptedAnswer":{"@type":"Answer","text":"SPF records allow a maximum of 10 DNS lookups, and each include: directive costs at least one lookup, with nested includes adding more. Stacking enough providers silently breaks SPF with a permerror. Also, having two separate TXT records that both start with v=spf1 is an error that causes SPF to fail entirely; a second provider must be merged into the existing single record instead. daily.dev helps developers troubleshoot email deliverability issues like SPF lookup limits before they hit production."}},{"@type":"Question","name":"What is the safe rollout order for enabling DMARC without blocking legitimate email?","acceptedAnswer":{"@type":"Answer","text":"Set up SPF and DKIM first and confirm both pass, then publish DMARC with p=none and a rua reporting address so nothing changes for delivery while aggregate reports reveal every legitimate sender that might otherwise get blocked. After watching reports for two to four weeks, move to p=quarantine starting at pct=25 and ramping to 100, then switch to p=reject once reports are clean. daily.dev keeps developers on top of DMARC rollout steps so a policy change doesn't quietly block real mail."}}]} ```