SPF, DKIM and DMARC: The Email Deliverability Setup Checklist

SPF, DKIM and DMARC are three DNS records that together answer one question for a receiving mail server: is this message really from the domain it claims? Without all three, major mailbox providers will not accept bulk mail from you at all. With them misconfigured, you will spend weeks blaming your list for a DNS problem.

Here is what each does, in the order you should set them up.

SPF: which servers may send for you

SPF (Sender Policy Framework) is a DNS TXT record listing the servers authorised to send email using your domain. A receiving server compares the sending IP against that list.

Two things break SPF in practice:

• The ten-lookup limit. SPF permits a maximum of ten DNS lookups when evaluating a record. Every include: costs at least one. Stack up an ESP, a CRM, a helpdesk, an invoicing tool and a marketing platform and you will exceed it – at which point SPF returns a permanent error and fails for everyone.
• Multiple SPF records. A domain may have exactly one. Two records is not additive; it is invalid, and receivers treat it as a failure. Merge the mechanisms into a single record instead.

Audit your record whenever you add a new sending tool, and flatten includes if you are near the limit.

DKIM: a signature that proves nothing was altered

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the message header. Your sending platform signs with a private key; the public key is published in your DNS. The receiver verifies the signature, confirming the message came from an authorised sender and was not modified in transit.

Practical points:

• Use a 2048-bit key where your provider supports it.
• Every sending service needs its own selector and key – your ESP, your CRM and your transactional provider each sign separately.
• Rotate keys periodically, and remove DNS records for services you have stopped using.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) does two jobs. It tells receivers what to do with mail that fails SPF and DKIM, and it sends you reports about who is sending as your domain.

The policy values:

• p=none – monitor only. Nothing is rejected. This satisfies the minimum requirement from Google, Yahoo and Microsoft, and it is where you start.
• p=quarantine – failing mail goes to spam.
• p=reject – failing mail is refused outright. The strongest protection against domain spoofing, and where you should eventually land.

A minimal starting record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Do not jump straight to p=reject. Run p=none for several weeks, read the aggregate reports, and confirm every legitimate sending source is passing before you tighten. Otherwise you will start rejecting your own invoices.

Alignment: the part everyone misses

Passing SPF or DKIM is not sufficient on its own. Google requires that the organisational domain in your visible From: header matches the domain that authenticated.

The classic failure: you send from hello@yourbrand.com, but the envelope sender your ESP uses is bounce@esp-servers.net. SPF passes – for the ESP’s domain. Alignment fails, because that is not the domain your recipient sees.

The fix is a custom sending domain or return-path at your ESP, usually a subdomain like mail.yourbrand.com, authenticated under your own organisational domain. Every serious sending platform supports this. Set it up before you send anything at volume.

Setup order

1. Inventory every system that sends email as your domain. Marketing platform, CRM, helpdesk, billing, notifications, anything.
2. Publish one SPF record covering all of them, staying under ten lookups.
3. Enable DKIM signing on each platform and publish each public key.
4. Configure a custom return-path or sending subdomain so alignment passes.
5. Publish DMARC at p=none with a reporting address.
6. Read the reports for two to four weeks and fix any legitimate source that is failing.
7. Move to p=quarantine, then p=reject.

How to verify it actually works

Send a test message to an account at a provider you care about and inspect the raw headers. You are looking for three lines reading dkim=pass, spf=pass and dmarc=pass. Anything else is a finding, not a detail.

Do this again after every change to your sending stack. Adding a new tool is the most common way a working setup silently breaks.

Authentication is necessary, not sufficient

Correct authentication gets your mail evaluated. It does not get it delivered. A perfectly authenticated campaign sent to a list full of dead addresses and spam traps still lands in spam, because the provider is now confident about exactly who is sending the bad mail.

Pair authentication with list hygiene and you have covered both halves of what mailbox providers actually grade. The full requirement set is in the bulk sender checklist.

Ready to see what is actually in your list? EmailListClean verifies up to 10,000 addresses a minute at 99.2% accuracy, from $100 for 250,000 emails. Start with 100 free credits or see volume pricing.