SPF, DKIM, DMARC — what actually lands in the inbox

If your email is landing in spam, nine times out of ten it isn't your subject line. It's that the receiving server can't prove the message is really from you. Three DNS records fix that — SPF, DKIM, and DMARC — and almost everyone sets them up in the wrong order, or stops halfway. Here's what each one does, in plain English, and the sequence we follow on every sending domain we touch.

The problem all three records solve

Email was designed in a more trusting era. By default, anyone can send a message claiming to be from your domain, and nothing stops them. Spammers and phishers exploit exactly that. So Gmail, Outlook, and every other inbox provider now ask a simple question of every incoming message: can you prove this is legitimate?

SPF, DKIM, and DMARC are the three ways you answer "yes." They work together, and as of 2024 the big providers don't treat them as optional anymore — bulk senders without them get throttled or rejected outright.

SPF — who's allowed to send for you

SPF (Sender Policy Framework) is a public list, published in your DNS, of the servers permitted to send email on behalf of your domain. When a message arrives, the receiver checks: did this come from an IP on the approved list?

It's a single TXT record that looks roughly like v=spf1 include:_spf.google.com include:sendgrid.net -all. The two things people get wrong:

The 10-lookup limit. SPF allows a maximum of ten DNS lookups. Stack up too many include statements — one per tool that sends mail for you — and the whole record silently fails. We flatten and audit these regularly.
Ending in ~all forever. The soft-fail is fine while you're testing, but it tells receivers "treat unknown senders as merely suspicious." Once you're confident, -all (hard fail) is the stronger signal.

DKIM — proof the message wasn't tampered with

SPF checks where a message came from. DKIM (DomainKeys Identified Mail) checks that the message itself is genuine and unaltered. Your sending platform signs each email with a private cryptographic key; you publish the matching public key in DNS. The receiver verifies the signature. If even a header was changed in transit, the check fails.

DKIM is what lets a receiver trust the content, not just the source. It also survives forwarding far better than SPF does, which matters more than people expect. Set it up for every platform that sends on your behalf — your marketing tool, your CRM, your helpdesk — each gets its own signature.

DMARC — your policy, and your visibility

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the first two together and adds the part everyone skips: instructions and reporting. It tells receivers what to do when a message fails SPF and DKIM — and asks them to send you reports on what's being sent in your name.

A DMARC record carries a policy:

p=none — monitor only. Don't act on failures, just report. This is where you start.
p=quarantine — send failing mail to spam.
p=reject — refuse failing mail outright. This is the goal.

Those reports are gold. They show you every service sending mail as your domain — including the legitimate ones you forgot about and the spoofers you didn't know existed.

The order we actually set them up

1. SPF first — publish the approved-senders list and verify every legitimate tool is on it.

2. DKIM next — turn on signing for each sending platform and confirm the keys validate.

3. DMARC at p=none — start collecting reports for a few weeks before you enforce anything. You'll always find a sender you didn't know about.

4. Tighten gradually — move to quarantine, then reject, once the reports are clean. Jumping straight to reject is how you accidentally block your own invoices.

Why the order matters so much

The single most common way teams break their own email is enforcing DMARC before they've found every legitimate sender. You set p=reject, feel responsible, and a week later finance calls because the accounting system's automated emails are vanishing. They were never in your SPF record and never DKIM-signed, so DMARC did exactly what you told it to.

Authentication isn't a switch you flip. It's a list you complete — and DMARC reports are the only way to know when the list is actually finished.

This is table stakes, not the whole game

Getting these three records right gets you to the starting line: receivers will accept that your mail is genuinely yours. It does not guarantee the inbox. Reputation still depends on how you warm up a new domain, how clean your list is, how many people mark you as spam, and whether you're sending content people actually want.

But none of that matters if you fail authentication, because the message never gets the chance to be judged on its merits. SPF, DKIM, and DMARC are the price of admission. Pay it first, in the right order, and everything else you do to land in the inbox actually has a chance to work.