Guide · 6 minute read
SPF, DKIM and DMARC in plain English
The three records inboxes check before they trust your email, what each one does, and the mistakes that send newsletters to spam.
Since February 2024, Gmail and Yahoo require anyone sending in bulk to prove their mail is really theirs. Three DNS records do the proving. You set them once, where your domain is hosted, and then forget them.
SPF: who may send as you
SPF is one TXT record on your domain that lists the services allowed to send mail for it, like your office email and your newsletter tool. Inboxes compare the sending server against that list.
- Have exactly one SPF record. Two records count as broken.
- Stay under 10 lookups: every include: costs at least one. Remove services you've stopped using.
- End it with ~all (soft fail) or -all. Never +all, which lets anyone send as you.
DKIM: a signature on every email
DKIM adds a cryptographic signature to each message; the matching public key sits in your DNS. If the signature checks out, the inbox knows the message really came from your domain and wasn't changed on the way.
- Every service that sends as you needs its own DKIM record. They live side by side under different names (selectors).
- DKIM is the record that matters most for newsletters: it's what lets DMARC pass even when mail goes through a provider's servers.
DMARC: what to do when checks fail
DMARC is a TXT record at _dmarc.yourdomain.com. It tells inboxes what to do with mail that claims to be from you but fails SPF and DKIM, and it's now required for bulk senders.
- Start with v=DMARC1; p=none; which only monitors and never blocks your mail.
- Once every service you use signs with DKIM, you can move to p=quarantine, then p=reject, to stop people faking your domain.
- Keep exactly one DMARC record.
The other rules bulk senders must follow
- A one-click unsubscribe in every marketing email (Flatstamp adds it for you).
- Spam complaints well under 0.3% (aim for under 0.1%).
- Only mail people who asked to hear from you.
Check yours in ten seconds
Our free checker reads your domain's records and tells you, in plain words, what to fix. No sign-up.