DNS Records Explained: MX, SPF, DKIM & DMARC

If you've ever set up custom domain email, you've likely been asked to add records with these four names to your domain's DNS settings, often with little explanation of what they actually do. Here's what each one is really for.

MX (Mail Exchange)

The MX record tells the internet which mail server is actually responsible for receiving email sent to your domain. Without a correctly configured MX record, email addressed to [email protected] has nowhere to go — this is the most fundamental of the four, and mail simply won't arrive without it.

SPF (Sender Policy Framework)

SPF is a list of servers that are authorized to send email on behalf of your domain. When another mail server receives an email claiming to be from [email protected], it can check your domain's SPF record to see if the sending server is actually on the approved list — this is a real, meaningful defense against attackers spoofing your domain to send phishing email that appears to come from you.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outgoing email, tied to your domain via a public key published in DNS. The receiving server can verify that signature to confirm the email genuinely came from your domain's mail system and wasn't altered in transit — a stronger, cryptographic complement to SPF's simpler server-list approach.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together into a policy: it tells receiving mail servers what to do when an email fails those checks (quarantine it, reject it outright, or just monitor and report) and where to send reports about authentication failures. Without a DMARC policy, SPF and DKIM can still be checked, but there's no consistent instruction for what a receiving server should actually do about failures.

Why This All Matters

Missing or misconfigured versions of these records are one of the most common real reasons legitimate business email ends up in spam folders — see our related post on why emails go to spam for more on diagnosing that specific problem. Getting these four records right is foundational, technical work that pays off directly in whether your email actually reaches people.