How DNS and Email Authentication Work
This one teaches the concepts and sells nothing. If you have been handed responsibility for a domain and the words SPF, DKIM and DMARC are being used at you as though you already know them, start here — three minutes, plain English, no product required.
What you'll take away
- What DNS is and why every domain needs it to point at an IP address.
- What a TXT record is, and how an SPF record is assembled inside one.
- SPF: which servers are allowed to send mail for your domain.
- DKIM: a cryptographic signature proving a message was not altered.
- DMARC: the policy that tells receivers what to do when SPF and DKIM fail.
DNS and IP addresses, without the jargon
Every server on the internet is reachable by a number — an IP address. People are bad at remembering numbers, so DNS exists as the lookup layer that turns a name like example.com into the address a machine can actually connect to.
Once you have that, the rest follows. DNS does not only hold addresses: it holds mail routing (MX records), text entries (TXT records), nameserver delegation (NS records) and more. Email authentication is built almost entirely out of TXT records, which is why a topic that sounds like cryptography turns out to be a DNS topic.
How an SPF record is built
An SPF record is a single TXT record listing the servers permitted to send email using your domain. It starts with a version tag, lists sources — individual IP addresses, or include: references to a provider's own published list — and ends with a qualifier saying what to do with everything else.
That final qualifier does most of the work. -all means anything not listed is unauthorised. ~all is a softer signal. The video walks through the anatomy of a real record piece by piece.
Why SPF, DKIM and DMARC need each other
SPF checks where a message came from. DKIM adds a cryptographic signature that proves the message was not modified in transit and genuinely came from the domain it claims. Neither alone tells a receiving mail server what to actually do when a check fails.
DMARC is that missing instruction. It ties the SPF and DKIM results back to the visible From address, publishes a policy — monitor, quarantine or reject — and asks receivers to send reports. The three together are what make a domain hard to spoof; any one of them on its own leaves a gap.
Questions
- Do I need a DNSai account to follow this video?
- No. It is a concepts explainer — nothing in it requires an account or a product.
- What should I read next?
- The Email Security guide covers SPF, DKIM and DMARC in written form, and the DNS Record Types reference documents every record mentioned in the video.
Try what's in the video
More DNSai videos
← Back to the Media CenterAll videos, guides and brand resources