Email authentication: SPF, DKIM, DMARC
TL;DR
SPF, DKIM and DMARC are DNS records that prove which servers may send e-mail for your domain. Without them anyone can send mail in your name, and Gmail and Yahoo send your own mail to spam.
Explain Simply
Your domain is like your company stamp. SPF is the list of post offices allowed to use the stamp, DKIM is a seal on each letter, and DMARC tells the receiver what to do with a letter that has a fake stamp: deliver it, put it aside, or throw it away.
SPF (Sender Policy Framework) is one TXT record on your domain that starts with v=spf1 and lists the servers and services that send your mail, ending in ~all (soft fail) or -all (hard fail). A domain may have only ONE SPF record — two records make SPF fail completely (RFC 7208). "+all" allows every server on the internet and is as bad as no record.
DKIM adds a cryptographic signature to each message; your mail service gives you the DNS record to publish.
DMARC is a TXT record at _dmarc.
Since 2024 Gmail and Yahoo require SPF or DKIM from every sender, and DMARC from bulk senders.
⚡Why It Matters
E-mail is how a business sends quotes, invoices and newsletters. Forged mail in your name damages the brand that your website builds, and a domain without authentication gets its real mail filtered. Search engines do not rank on SPF or DMARC, but trust in the brand is the same trust that makes people click and buy.
🔍How CiteStat Checks
CiteStat reads the domain's DNS over HTTPS: the TXT records on the zone apex (SPF), and _dmarc.
CiteStat Score Impact
Shown in the Technical card as advice. No points are deducted — this is trust and deliverability, not a ranking factor.
Fix Difficulty
Editor: N/A | Developer: Easy | AI Agent: Easy