Email authentication records

This guide explains what SPF, DKIM and DMARC do, why each domain needs its own values, and where to get the exact values for your email service.

Email authentication records tell receiving servers whether a message really comes from your domain.

• SPF is a TXT record that lists the servers allowed to send mail for your domain. A domain should have one SPF record. Two records make SPF fail.
• DKIM is a TXT record with a public key. Your mail service signs each message with a private key, and receivers check the signature against this record. The key is different for each domain.
• DMARC is a TXT record at _dmarc that evaluates alignment with the visible From domain. It passes when at least one aligned SPF or DKIM result passes. The policy guides handling when both aligned mechanisms fail.

APNCloud does not give one universal DKIM key or one DMARC value for every customer. Get the exact values from the email service you use:

• APNCloud Business Email: SPF, DKIM and DMARC
• Hosting email: the values shown in your hosting account

Do not copy records between products. A record for one service can make another service's mail fail.

Related articles

• TXT records
• MX records
• Emails going to spam
• Email authentication errors

Last reviewed

2026-10-28