SPF, DKIM, DMARC & PTR: How They Work Together

Updated 5 November 2026 · Standard formula, shown below

This guide explains how SPF, DKIM, DMARC, and PTR records work together to authenticate your email, prevent spoofing, and improve deliverability. You’ll learn what each record does, how they interact, and the exact steps to set them up correctly for your domain.

What You’ll Need

Access to your domain’s DNS management (where you edit records, e.g., at your domain registrar or hosting provider).
The IP address(es) of your email sending server(s).
Your email service provider’s DKIM selector and public key (usually found in their setup guide).
A way to send test emails (e.g., your normal email client or a tool like mail-tester.com).

Step-by-Step

Understand the roles: SPF (Sender Policy Framework) lists which IP addresses are allowed to send mail for your domain. DKIM (DomainKeys Identified Mail) adds a digital signature to your emails that can be verified against a public key in DNS. DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do if SPF or DKIM fail, and PTR (Pointer record) maps an IP address back to a domain name (used for reverse DNS).
Set up SPF: Create a TXT record at your domain root (e.g., example.com) with the value: v=spf1 ip4:YOUR_IP include:your_provider.com -all. Replace YOUR_IP with your sending IP and your_provider.com with your email service’s include (if any). The -all at the end means only these IPs are allowed; use ~all for soft fail during testing.
Add DKIM: Your email provider will give you a DKIM record. It’s usually a TXT record with a name like selector._domainkey (e.g., default._domainkey). The value is a long string starting with v=DKIM1; k=rsa; p= followed by your public key. Add this record exactly as provided.
Create a DMARC record: Add a TXT record at _dmarc.yourdomain.com with a value like: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start with p=none to monitor without affecting delivery. Later, change to p=quarantine or p=reject once you confirm legitimate mail passes.
Set up PTR (reverse DNS): Contact your hosting provider or IP owner to create a PTR record for your sending IP address. The PTR should point to a hostname (e.g., mail.yourdomain.com). This hostname should have a matching forward A record pointing back to the same IP.
Test your setup: Send a test email to a service like mail-tester.com or use a Gmail address and view the original message to check SPF, DKIM, and DMARC results. Ensure all pass.
Monitor and enforce: Check the DMARC reports you receive (if you set rua) to see if any legitimate emails are failing. Once you’re confident, tighten your DMARC policy to p=quarantine or p=reject.

Common Mistakes

Using multiple SPF records: You can only have one SPF record for your domain. If you add more, SPF fails. Combine all IPs and includes into a single record.
Forgetting the trailing dot in DNS values: Some DNS providers require a trailing dot at the end of hostnames (e.g., mail.example.com.). Check your provider’s syntax.
Setting DMARC to p=reject before testing: This can cause legitimate emails to be rejected. Always start with p=none and monitor.
Ignoring PTR alignment: Some receiving servers check that the PTR hostname matches the domain in the HELO/EHLO command. Ensure your sending server’s hostname is correct.
Not including all sending sources: If you use a third-party service (like a marketing platform), include their SPF include and DKIM selector, or your emails may fail authentication.

Tips

Use a tool like MXToolbox or Google Admin Toolbox to check your SPF, DKIM, and DMARC records before going live.
Keep your SPF record under the DNS limit of 10 lookups. Each include counts as a lookup, and exceeding 10 causes SPF to fail.
Set up a dedicated email address for DMARC reports (e.g., dmarc@yourdomain.com) so you can monitor authentication results.
Align your PTR hostname with your sending domain (e.g., mail.yourdomain.com) to improve deliverability.
Regularly review your DMARC reports to ensure no legitimate senders are missing authentication.

Troubleshooting

If your emails are not passing authentication:

SPF fails: Check that your SPF record includes all sending IPs. Use an SPF lookup tool to see which IPs are allowed. Also, ensure you don’t have multiple SPF records.
DKIM fails: Verify the DKIM selector and public key are correct. Ensure the DNS record is propagated (wait a few hours). Check if your email provider uses a different selector for different sending streams.
DMARC fails: DMARC can fail even if SPF or DKIM pass if the domain alignment is not correct. For SPF, the domain in the From header must match the domain in the envelope sender (or be in the same parent domain). For DKIM, the d= domain in the signature must match the From domain.
PTR issues: If your PTR record is missing or incorrect, some servers may reject your mail. Contact your IP provider to fix it. Ensure the PTR hostname has a forward A record that resolves back to the same IP.
Propagation delay: DNS changes can take up to 48 hours to propagate. Wait and re-test.

Frequently Asked Questions

Q: Do I need all four records?
A: SPF, DKIM, and DMARC are essential for modern email authentication. PTR is strongly recommended, especially for dedicated IPs, as many receiving servers check it.

Q: What is DMARC alignment?
A: DMARC alignment checks that the domain in the From header matches the domain used in SPF (envelope sender) or DKIM (signature domain). It can be strict (exact match) or relaxed (parent domain match).

Q: Can I use SPF and DKIM without DMARC?
A: Yes, but DMARC tells receivers what to do if SPF or DKIM fail. Without DMARC, your emails may be delivered to spam or rejected inconsistently.

Q: How long does DNS propagation take?
A: Typically a few minutes to 48 hours, but usually under an hour. Use online DNS checkers to see if your records are live.

Q: What if I use a third-party email service?
A: Your provider will give you specific SPF include and DKIM records. Follow their instructions and add them to your DNS.

Q: What does the p=none DMARC policy do?
A: It tells receivers to take no action on failed emails, but still sends reports. It’s a monitoring mode, useful before enforcing stricter policies.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.