How to set up SPF, DKIM, and DMARC for your sending domain
7 hours ago
- Email authentication (SPF, DKIM, DMARC) is critical to prevent messages from landing in spam or being bounced.
- SPF authorizes sending server IPs, DKIM provides a cryptographic signature for message integrity, and DMARC ties both to the visible From address.
- All three are DNS records that receiving mail servers check; missing records can block ordinary mail like password resets and invoices.
- Gmail requires SPF or DKIM for all senders, and all three for those sending ~5,000 messages/day to personal Gmail accounts.
- DMARC alignment ensures that SPF or DKIM passes for a domain matching the From address; misalignment is a common cause of failure.
- Setup involves adding DKIM CNAME records, configuring SPF on the Return-Path domain, and publishing a DMARC policy starting with p=none.
- After setup, send a real message and check authentication headers (e.g., in Gmail) to verify dmarc=pass.
- Common issues include duplicate SPF records, proxied CNAMEs, and non-aligned domains; reputation problems require volume management, not more records.
- Use a subdomain for transactional mail to avoid mixing with staff email records, and consider services like Cloudflare for automated DNS setup.