Email DNS records (MX, SPF, DKIM, DMARC)

An overview of the four DNS record types that make your business email work correctly and land in inboxes rather than spam.

Getting your domain's email to work reliably — and to reach inboxes rather than spam folders — depends on four types of DNS records. This guide introduces all four and explains how they work together. For a deeper dive into each one, follow the links to the dedicated guides.

Quick summary

Four DNS records power your business email: MX records route incoming mail to your email provider, SPF tells servers which senders are authorized to send on your behalf, DKIM cryptographically signs outgoing email, and DMARC tells receiving servers what you want done with messages that fail those checks. All four need to be set up correctly.

Why email DNS records matter

Faking a sender address is a standard move in phishing and business email compromise. Microsoft describes email authentication as "a group of standards to identify and prevent the delivery of email messages from forged senders". Email providers use your DNS records to check that mail claiming to come from @yourbusiness.com really is authorized by you.

If your DNS records are missing or incorrect:

Your emails may land in recipients' spam folders
Email providers may refuse to deliver your messages at all
Fraudsters may be able to impersonate your email address more easily

Setting up all four record types is one of the most important things you can do for email reliability.

The four records at a glance

Record	Type	What it does
MX	MX	Routes incoming email to your mail server
SPF	TXT	Lists servers authorized to send email from your domain
DKIM	TXT	Adds a cryptographic signature to prove emails are genuine
DMARC	TXT	Sets the policy for handling email that fails authentication

MX records

MX (Mail Exchange) records tell the internet which servers handle incoming email for your domain. When someone sends an email to you@yourbusiness.com, their email system looks up your MX records to find out where to deliver it.

Your email provider (Google Workspace, Microsoft 365, Zoho, etc.) provides the MX record values when you set up your account. If these records are wrong or missing, incoming email won't arrive.

Each MX record has a priority number, and the lowest number wins: the mail standard says records are "ordered by preference, with the lowest-numbered records being most preferred". How many you need depends on the provider. Some give you several at different priorities; Google Workspace now uses a single MX record, smtp.google.com, at priority 1, though accounts set up before 2023 may still have a set of older ones that start with aspmx.

See DNS records explained (A, CNAME, MX, TXT) for more on how records are written.

SPF records

SPF (Sender Policy Framework) is a TXT record that lists all the mail servers and services authorized to send email from your domain. When someone receives an email claiming to be from @yourbusiness.com, their server checks your SPF record to see if the sending server is on the list.

If the sending server isn't listed, the email may be flagged as suspicious. A typical SPF record looks like:

v=spf1 include:_spf.google.com ~all

That's Google's own published value for a domain that sends only through Google Workspace. It tells receivers: "Emails from our domain should come from Google's servers. Be suspicious of others." Add a second service — a newsletter tool, a CRM — and it needs its own include: in the same record.

See SPF records, explained for a full guide.

DKIM records

DKIM (DomainKeys Identified Mail) uses cryptography to sign outgoing emails. Your email provider creates a digital signature that's attached to every email. Receiving servers use a public key (stored in your DNS as a TXT record) to verify the signature.

If the signature matches, the email is verified as genuine. If it doesn't match — or there's no signature — receivers may treat the email with suspicion.

DKIM records are created by your email provider and usually look like a long string of random characters in DNS.

See DKIM records, explained for a full guide.

DMARC records

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It publishes what you, as the owner of the domain, think should happen to mail that fails the check. One aligned pass is enough: a message passes DMARC when SPF or DKIM passes and the domain that passed matches the address in the From line, so your policy only comes into play when neither does.

There are three policies:

none — you express no preference. Useful while you read the reports and work out who sends mail as you.
quarantine — you consider such mail suspicious. The standard's wording is that "it is possible the mail is valid, although the failure creates a significant concern". In practice receivers usually treat it as spam.
reject — you consider a failure "a clear indication that the use of the domain name is not valid", so receivers should refuse the message outright.

The policy is a request rather than a switch you control: the receiving server decides what it actually does. DMARC also sends reports to an address you specify, so you can see who is sending email using your domain.

See DMARC records, explained for a full guide.

How they work together

You send an email from you@yourbusiness.com via Google Workspace.

The recipient's mail server takes delivery and looks up your domain's DNS to check the message. (Your MX records aren't part of this — those only matter for mail coming in to you.)

SPF is checked — is Google's server on your authorized list? Yes.

DKIM is verified — does the signature on the email match the public key in DNS? Yes.

DMARC is applied — both checks passed and align with your domain, so email is delivered normally.

If neither SPF nor DKIM produces a pass that matches your From address, the message fails DMARC and your policy tells the receiver what you'd like done about it. See DMARC records, explained.

Common questions

Do I need all four records?

MX records are essential for receiving email. SPF and DKIM are no longer optional in practice: Google's rule is that every sender to personal Gmail accounts "must Set up SPF or Set up DKIM", and that bulk senders — more than 5,000 messages daily — "must Set up SPF, Set up DKIM, and Set up DMARC". Microsoft's position is that "internet domains need SPF, DKIM, and DMARC to work together for effective email authentication". Set up all four and you're covered either way.

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

Learn more

Cloudflare DNS docs — Set up email records