If your emails keep landing in spam, or you've been told to "set up SPF, DKIM and DMARC" and have no idea where to start, this guide is for you. All three of those live in a single, humble type of DNS setting: the TXT record. Once you understand what a TXT record is and how these three email-authentication standards work together, a confusing corner of DNS suddenly makes sense — and your email deliverability improves. Here's the plain-English version.

What is a TXT record?

A TXT record is a DNS record that holds a piece of text. Originally it was meant for human-readable notes, but today it's used almost entirely for machine-readable verification — small text values that prove things about your domain to other services.

TXT records do two main jobs. First, domain verification: when Google, Microsoft, or another service asks you to "add this TXT record to prove you own the domain," that's what's happening. Second — and most importantly — email authentication, through three standards called SPF, DKIM and DMARC. You can see any domain's TXT records with our free DNS Records tool; our guide on how to look up DNS records covers reading the results.

The email-authentication trio: SPF, DKIM & DMARC

Email was designed decades ago with no built-in way to verify that a message really came from who it claims. That's why spam and spoofing are so easy. SPF, DKIM and DMARC are the modern fixes — three TXT records that, together, prove your email is legitimate so receiving servers trust it instead of dumping it in spam.

SPF — who is allowed to send

SPF (Sender Policy Framework) is a TXT record that lists which mail servers are allowed to send email on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks your SPF record: if the sending server is on the approved list, it passes; if not, it's suspicious.

An SPF record looks something like v=spf1 include:_spf.google.com ~all, where the include lines authorize your email providers and the ending (~all or -all) tells receivers how strictly to treat anything not listed. A domain should have exactly one SPF record — multiple SPF records break authentication.

DKIM — proof the message wasn't tampered with

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. Your mail server signs outgoing messages with a private key, and the matching public key is published as a TXT record in your DNS. The receiving server uses that public key to confirm two things: the message genuinely came from your domain, and it wasn't altered in transit. DKIM is what lets a receiver trust the integrity of your mail, not just the sending server.

DMARC — the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting & Conformance) sits on top of SPF and DKIM and sets the rules. Its TXT record (published at _dmarc.yourdomain.com) tells receiving servers what to do when a message fails SPF and DKIM checks: do nothing (p=none), send it to spam (p=quarantine), or reject it outright (p=reject). DMARC also lets you receive reports showing who's sending email using your domain — invaluable for spotting spoofing and phishing attempts against your brand.

How the three work together

Think of it as a security checkpoint for your email:

  • SPF checks the sender is on the guest list (an authorized server).
  • DKIM checks the message's seal is intact (a valid signature).
  • DMARC decides what happens if either check fails, and reports back to you.

Used together, they make it dramatically harder for anyone to impersonate your domain — and they signal to inbox providers that your mail is trustworthy.

Why TXT records matter more than ever

This isn't just best practice anymore. Major providers like Gmail and Yahoo now require SPF, DKIM and DMARC for bulk senders, and increasingly scrutinize everyone else. If these records are missing or misconfigured, the consequences are real:

  • Your legitimate emails land in spam or get rejected.
  • Scammers can more easily spoof your domain to send phishing emails in your name.
  • Your domain's sending reputation suffers over time.

If your incoming mail arrives fine but your outgoing mail keeps getting flagged, the problem is almost always these TXT records — not your MX records, which only control where incoming mail is delivered.

How to check your TXT records

You can view any domain's TXT records in seconds. The easiest way is our free DNS Records tool — enter your domain and read the TXT entries. From the command line:

nslookup -type=TXT example.com
dig example.com TXT +short
dig _dmarc.example.com TXT +short

Swap example.com for your domain. Your SPF record sits on the root domain, your DMARC record on _dmarc.yourdomain.com, and DKIM on a provider-specific selector like selector._domainkey.yourdomain.com. After adding or changing any of them, remember that DNS changes take time to propagate, and you may need to flush your DNS cache to see the latest values.

The bottom line

A TXT record is just text stored in DNS — but it quietly powers the three standards that keep email trustworthy. SPF says who can send for your domain, DKIM proves your messages weren't tampered with, and DMARC sets the policy and reports on abuse. Together they keep your email out of spam and stop others from impersonating you. Check yours with a free DNS Records lookup, make sure all three are present and correct, and your email deliverability — and your domain's reputation — will thank you.