SPF, DKIM and DMARC are three DNS records that prove an email really comes from your domain. Without them, many of your emails land in spam or are rejected. They are necessary but not sufficient: what you send, to whom and how often matters just as much.
What deliverability means
An email can be delivered and still never be seen. Delivered only means the receiving server accepted it. Deliverability asks the more useful question: did it reach the inbox, or the spam folder?
Mail providers such as Gmail, Outlook and Yahoo decide this for every message. They look at three things:
- Identity. Can the sender prove who they are? This is where SPF, DKIM and DMARC come in.
- Reputation. How have people reacted to mail from this domain before? Replies help. Spam complaints and bounces hurt.
- Content and behaviour. Does the message look like bulk advertising, and did the volume jump suddenly?
You control the first point completely, and it comes before everything else.
SPF, DKIM and DMARC explained
All three are text entries in the DNS settings of your domain. You add them where your domain is managed.
| Record | Plain meaning | Everyday picture |
|---|---|---|
| SPF | A list of the servers that are allowed to send mail for your domain. | A guest list at the door. |
| DKIM | A digital signature on each email. The receiver checks it against a public key in your DNS. It shows the mail comes from your domain and was not changed on the way. | A wax seal on a letter. |
| DMARC | A policy that tells receivers what to do when SPF and DKIM fail, and where to send reports. It also checks that the domain in the visible From address matches. | Instructions to the doorman, plus a visitor log. |
What the records look like, as examples only. Your mail provider gives you the exact values.
SPF, a TXT record on your domain:
v=spf1 include:_spf.yourprovider.com ~allDKIM, a TXT or CNAME record on a selector name such as selector1._domainkey.yourdomain.com. The long key comes from your mail provider.
DMARC, a TXT record on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
DMARC has three policy levels. p=none only watches and reports. p=quarantine asks receivers to put failing mail in spam. p=reject asks them to refuse it. Start with none, read the reports, and tighten the policy once all your real mail passes.
Set them up and check them
- List everything that sends mail as your domain. Your mailbox provider, your website form, your invoicing tool, your newsletter tool. Each one needs to be covered.
- Add one SPF record. Only one per domain. Two SPF records break SPF. Combine all senders in a single record.
- Switch on DKIM in the admin area of your mail provider and add the record it shows you.
- Add a DMARC record with p=none and a report address.
- Test. Send an email to a Gmail address, open it and choose Show original. You should see PASS next to SPF, DKIM and DMARC.
Common mistakes:
- Two SPF records on the same domain.
- A sending tool that is missing from SPF and has no DKIM of its own.
- DKIM switched on in the provider, but the DNS record never added.
- A strict DMARC policy set before checking that all real mail passes.
What Gmail and Yahoo expect since 2024
In 2024 Gmail and Yahoo began to enforce published sender requirements. Other providers have moved in the same direction. In short:
- All senders need to authenticate their mail with SPF or DKIM, have valid forward and reverse DNS, and keep spam complaints low.
- Bulk senders need SPF and DKIM and a DMARC record, with the From domain aligned. Google describes a bulk sender as one that sends about 5,000 or more messages a day to personal Gmail accounts.
- Marketing mail from bulk senders needs one-click unsubscribe, and the unsubscribe has to be processed quickly.
- Spam complaints: Google says to keep the rate reported in its Postmaster Tools below 0.3%, and recommends staying well under that.
A small sender will be far below the bulk level. Treat the requirements as the standard anyway. Google Postmaster Tools is free and shows the complaint rate and reputation for your domain once you have enough volume to Gmail.
What the three records cannot fix
Authentication proves who you are. It does not make your email welcome. A perfectly authenticated email that annoys people still goes to spam.
- Clean list. Verify addresses before sending. Many bounces signal a careless sender.
- Relevance. Write to people whose job fits your offer. Irrelevant mail gets reported.
- Low and steady volume. Many cold senders stay around a few dozen emails per mailbox per day and increase slowly. These are common cautious practice, not official limits. See how to warm up a new email domain.
- A separate domain for outreach. Many senders use a second domain close to their main one, so that a mistake does not hurt everyday business mail.
- Plain emails. Short text, few links, no attachments and no large images in a first message.
- An easy way out. A person who can say no easily is less likely to click the spam button.
Nobody can guarantee inbox placement. Providers do not publish their filters, and they change them.
A short checklist, and when to get help
- SPF: one record, all senders included.
- DKIM: switched on and passing.
- DMARC: record present, reports arriving.
- Test email to Gmail shows PASS three times.
- List verified, opt-outs removed.
- Postal address and opt-out line in every email.
Deliverability is the technical side. The legal side comes first: check whether cold email is allowed where your recipients are. If you would rather not touch DNS yourself, Astranode offers a cold email setup by quote. Domains and mailboxes are bought in your name, with SPF, DKIM and DMARC, warm-up and templates. It only sends to US and UK business addresses.
SPF says which servers may send, DKIM signs each message, DMARC sets the policy. Set up all three, test them in Gmail, then earn your reputation with relevant mail at low volume.