PickGlobe
If you send email from your own domain, three DNS records help receiving servers tell your real mail from forgeries. They are SPF, DKIM and DMARC. Here is what each one does, using UK government guidance.
This guide is based on the public sources listed at the end. We have not tested the products or services mentioned.
This is a short reference page. The full guide is Web Hosting and Domains: The Complete Guide.
The three records
| Record | What it does |
|---|---|
| SPF | Lists the IP addresses trusted to send email for your domain |
| DKIM | Adds a cryptographic signature showing the message came from your domain; works with forwarded mail, though it is less widely supported than SPF |
| DMARC | Tells receiving servers what to do with mail that fails SPF or DKIM, including discarding it, and sends you reports on how your mail is handled |
Together they make it harder for criminals to send fake email that appears to come from your domain.
What the UK NCSC recommends
The National Cyber Security Centre says to set up all three on every domain you own, including domains used with cloud email providers such as Google Workspace and Microsoft 365. It also advises making sure your email service sends and receives with TLS, and checking your setup with its free email security check. The guidance is aimed at organisations, and a small site can use the same three checks.
Questions for a host or email provider
- Is email included with the domain, or a separate paid product?
- Can I add SPF, DKIM and DMARC records in your DNS panel?
- What are the mailbox size and sending limits?
- How is spam handled?
The short version
Set up SPF, DKIM and DMARC for each domain you send from, then check the result. Our guide to domains and hosting explains where DNS records live.
Last checked: 15 October 2026. Sources: UK NCSC, email security and anti-spoofing.
