SPF, DKIM and DMARC, without the headache

If your email keeps landing in spam, there is a good chance one of three small records is missing or set up wrong. SPF, DKIM and DMARC are the checks Gmail, Outlook and Yahoo run before they decide whether to trust a message from your domain. Get them right and more of your mail reaches the inbox. Get them wrong, or skip them, and even honest email starts to look suspicious. This guide explains all three the way we wish someone had explained them to us: no acronyms left undefined, no assuming you run your own mail server. By the end you will know what each record does, how they work together, and the order to set them up so you never accidentally block your own mail.

The one-sentence version

• SPF is a guest list: which services are allowed to send email as you.
• DKIM is a tamper-proof seal: proof a message was not changed in transit.
• DMARC is the house rule: what a receiver should do when a message fails the first two, plus a report back to you.

You want all three. They are not alternatives, they are layers, and the big providers now expect every serious sender to have the full set.

SPF: the guest list

SPF (Sender Policy Framework) is a single line you publish in your domain’s DNS settings. It names every service allowed to send email on your behalf: your mailbox provider (Google Workspace, Microsoft 365), your newsletter tool, your CRM, your invoicing app. When a message arrives, the receiving server looks up your SPF record and checks whether the server that actually sent it is on the list.

Three things trip people up:

• The 10-lookup limit. SPF is capped at ten DNS lookups. Chain together too many services and the record silently breaks, which means it stops protecting you. If you have added tool after tool over the years, you are probably close to the edge.
• A catch-all that lets anyone in. A record ending in +all tells receivers to accept mail from anywhere claiming to be you. That is the opposite of a guest list. You almost always want ~all (soft fail) or -all (hard fail).
• The forgotten sender. The classic failure: you set up SPF, then months later start sending from a new tool and forget to add it. That tool’s mail now fails SPF and heads for spam.

SPF alone is not enough, because it only checks the envelope, not the visible “From” address a person actually reads. That gap is exactly what DKIM and DMARC close.

DKIM: the tamper-proof seal

DKIM (DomainKeys Identified Mail) puts a cryptographic signature on every message you send. Your sending service holds a private key and signs each email; you publish the matching public key in your DNS. The receiver checks one against the other. If they match, two things are proven: the message really came from a service authorized for your domain, and nobody altered it along the way.

The one detail worth knowing: key length. Modern setups use a 2048-bit key. Older 1024-bit keys are considered weak now, and some providers already discount them. If your DKIM was set up years ago and never touched, it is worth checking and upgrading.

DKIM survives forwarding better than SPF does, which is why receivers lean on it heavily. But on its own it still does not tell a receiver what to do when a check fails. That decision is DMARC’s job.

DMARC: the house rule (and your early-warning system)

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and adds two things nothing else gives you: a policy and reports.

The policy tells receivers what to do with mail that claims to be from you but fails its checks. There are three levels:

1. p=none — watch and report only. Nothing gets blocked. This is where everyone should start.
2. p=quarantine — send failing mail to the spam folder.
3. p=reject — refuse it outright.

The reports are the part most people never use, and they are gold. With DMARC at p=none, receivers send you a daily summary of every source sending mail under your name, including ones you forgot about and ones impersonating you. That is how you discover the old plugin still blasting from a dead server, or a scammer spoofing your domain.

The safe rollout, in order:

1. Publish DMARC at p=none.
2. Read the reports for two to four weeks until every legitimate sender passes SPF or DKIM.
3. Only then tighten to quarantine, and later reject.

Skip step two and move straight to reject, and you can block your own newsletter on day one. This is the single most common way people break their email while trying to fix it. (If reading raw DMARC reports sounds like a chore, that is precisely what Sendable’s Domain Health does: it collects the reports and turns them into plain English.)

The 2024 and 2025 rules changed the stakes

This used to be optional hygiene. It is not anymore. Google and Yahoo began enforcing stricter sender rules in February 2024, and Microsoft brought the same to Outlook, Hotmail and Live in May 2025. The rules formally kick in around 5,000 messages a day, but they are really the new baseline for everyone:

• Valid SPF and DKIM on your domain.
• A published DMARC record, even just at p=none.
• Your visible From address aligned with the domain you authenticate.
• One-click unsubscribe on marketing email.
• Spam complaints kept under 0.1%.

Meet these and your delivery holds up no matter how much you send. Ignore them and volume works against you.

Where to start

1. Check what you have now. Run your domain through a free audit (ours is on the homepage) and see which of the three are missing or misconfigured.
2. Fix SPF first, then DKIM, then publish DMARC at p=none.
3. Watch the DMARC reports for a few weeks before tightening the policy.

That order matters: authentication first, monitoring second, enforcement last. Do it in that sequence and you will never black-hole your own mail.

Common questions

Do I really need all three? Yes. Gmail, Yahoo and Microsoft now expect SPF, DKIM and DMARC together. Any one on its own leaves a gap the others close.

Will setting these up stop me landing in spam? It removes the most common technical reason mail gets filtered. Content, list quality and sending reputation still matter, but authentication is the foundation everything else sits on.

What DMARC policy should I use? Start at p=none and only move to quarantine or reject once your reports confirm every real sender passes. Rushing this is the main way people block their own email.

Can I set these up without a developer? Yes. Each one is a record you add in your domain’s DNS settings. Your registrar or mailbox provider has step-by-step docs, and a tool like Sendable checks your work and tells you what is still wrong in plain language.

Want the shortcut? Get beta access and Sendable audits your SPF, DKIM and DMARC in about two minutes, then watches your domain reports for you.