Email DNS explained (MX, SPF, DKIM, DMARC)
What is DNS for email?
DNS is the "address book" of the internet: it translates a domain name like yourbusiness.com into the servers that belong to it. That address book contains different kinds of records. Some point to your website, others to your email.
For email it comes down to two questions. First: where does my mail arrive? That's what the MX record handles. Second: how does the recipient know a message really comes from my domain and not from a scammer? That's what SPF, DKIM and DMARC handle. Without these records email doesn't work reliably: you miss mail, or your messages end up in spam.
The DNS records for email in short
| Record | What it does | For what |
|---|---|---|
| MX | indicates which server receives your mail | receiving email |
| SPF | says which servers may send on behalf of your domain | proving the sender |
| DKIM | puts a digital signature on your outgoing mail | proving the sender |
| DMARC | says what should happen if SPF or DKIM fails | policy + reporting |
Remember it this way: MX is for incoming mail, the other three are for outgoing mail and trust.
MX: where your mail arrives
The MX record ("Mail Exchange") tells the rest of the internet which mail server the email for your domain should go to. If someone mails you@yourbusiness.com, the sending server looks at your MX record to know where to deliver.
Without a correct MX record no mail comes in. So it's the first requirement for email on your own domain. We explain how to set it up in setting up MX records.
SPF: who may send on your behalf
SPF (Sender Policy Framework) is a list of servers that are allowed to send email on behalf of your domain. When a receiving server gets a message supposedly from yourbusiness.com, it checks: is the sending server on the SPF list? If not, that's a suspicious sign.
SPF protects you against misuse: it makes it harder for scammers to mail in your name. You'll find the explanation and the right setup in what is SPF.
DKIM: a digital signature
DKIM (DomainKeys Identified Mail) places an invisible digital signature on every message you send. The receiving server checks that signature with a key stored in your DNS. If it matches, it's proven that the message wasn't altered along the way and really comes from your domain.
Where SPF looks at the server, DKIM looks at the message itself. Together they're stronger than apart. More in what is DKIM.
DMARC: the policy that binds it all
DMARC (Domain-based Message Authentication) is the instruction that says what a recipient should do if SPF or DKIM doesn't check out: do nothing, put it in spam, or reject it. On top of that, DMARC sends you reports, so you can see who is mailing on behalf of your domain, including misuse.
DMARC only works if SPF and DKIM are already in place; it builds on them. See what is DMARC for the details.
How they work together
Suppose you send a mail. On the recipient's side this happens: the server doesn't use your MX (that's for incoming mail), but checks SPF (was this server allowed to send?), DKIM (does the signature check out?) and then applies the DMARC policy (what to do if something doesn't add up). If those checks pass, your message gains trust and lands in the inbox instead of spam.
For incoming mail it's simpler: senders find you via your MX and deliver there. So the four records complement each other: one for receiving, the other three for trustworthy sending.
What to watch out for
- Order counts. Set up MX first (to receive), then SPF and DKIM, and only then DMARC (which relies on the other two).
- One typo breaks the whole thing. DNS records are exacting. Copy values exactly.
- Give it time. Changes aren't visible worldwide right away; count on a few hours.
- Start cautiously with DMARC. Begin with an "observe" policy before you let messages be rejected, so you don't accidentally block legitimate mail.
To get all three trust records right in one go, follow setting up SPF, DKIM and DMARC.
And at Mailflux
At Mailflux you don't have to dive into DNS to get it right. If you bring your own domain, you get the exact values for MX, SPF, DKIM and DMARC and we help you connect it; if you let Mailflux register and manage a domain, we set everything up correctly straight away. Your email runs on your own domain, hosted in Europe and GDPR-compliant, with antivirus, antispam, antimalware and backups in every plan.
That way your mail arrives reliably and leaves with the right proof, without you having to figure out the technology on your own. You can read more about mailing with your own name after the @ in email on your own domain.
FAQ
Frequently asked questions
Which DNS records do I need for email?
For email on your own domain you need an MX record to receive mail, and SPF, DKIM and DMARC to send as a trustworthy sender. The MX record is required to receive mail; the other three ensure your messages arrive instead of ending up in spam.
What's the difference between SPF, DKIM and DMARC?
SPF says which servers may send on behalf of your domain. DKIM puts a digital signature on your messages. DMARC determines what happens if SPF or DKIM fails and sends you reports. They work together: SPF and DKIM prove, DMARC decides and reports.
What happens if these records aren't correct?
If your MX record isn't correct, you receive no mail. If SPF, DKIM and DMARC are missing or fail, recipients trust your messages less and they end up in spam more often, or don't arrive at all. Correct records increase the chance of clean delivery.