Email deliverability: SPF, DKIM and DMARC explained simply

We earn a commission if you buy through some links on this page, at no extra cost to you. It never affects the order. How we make money.

SPF, DKIM and DMARC are three email authentication records that prove your emails really come from your domain. Without them, your newsletters, invoices and even ordinary replies are more likely to land in spam, and criminals can more easily send fake emails pretending to be you. Major inbox providers now require them for bulk senders. This guide explains what each record does in plain language, how to set them up step by step, and how to fix common deliverability problems.

What email deliverability means

Deliverability is whether your emails reach the inbox rather than the spam folder or nowhere at all. Inbox providers such as Gmail, Outlook and Yahoo decide where to place each email based on many signals: whether the sender is authenticated, the sender's reputation, whether recipients engage with the emails or mark them as spam, and the content itself.

Authentication is the foundation. Without it, even good emails from a legitimate business can be treated as suspicious.

Why it matters for small businesses

Poor deliverability affects more than marketing. Invoices, quotes, password resets and replies to customers can go to spam if your domain is not set up correctly. Meanwhile, without DMARC, scammers can send emails that appear to come from your domain, for example fake invoices to your customers with changed bank details. Setting up SPF, DKIM and DMARC protects both your inbox placement and your customers. See how to prevent invoice fraud.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain. When an email arrives, the receiving server checks whether it came from a server on your list.

An SPF record is a TXT record on your domain that looks something like v=spf1 include:_spf.google.com include:sendingservice.com ~all. Each "include" adds a service, such as your email provider and your email marketing tool. A domain must have only one SPF record; if you use several services, combine them in one record. SPF also has a limit of ten DNS lookups, so avoid adding services you no longer use.

DKIM: a digital signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email. The sending service signs the email with a private key, and publishes the matching public key in your domain's DNS. The receiving server checks the signature, confirming the email was sent by an authorised service and was not changed in transit.

Each sending service, such as your email host and your marketing tool, gives you its own DKIM record to add, usually a TXT or CNAME record with a "selector" name. You can have several DKIM records, one per service.

DMARC: the policy and the reports

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together. It tells receiving servers what to do with emails that fail authentication, and asks them to send you reports. DMARC also checks alignment: that the domain in the visible "From" address matches the domain authenticated by SPF or DKIM.

A DMARC record is a TXT record at _dmarc.yourdomain.com, such as v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. The policy (p) can be none (monitor only), quarantine (send failing emails to spam) or reject (block them).

Bulk sender requirements

In 2024, Google and Yahoo introduced requirements for bulk senders, generally those sending around 5,000 or more emails a day to their users. Bulk senders must authenticate with SPF and DKIM, publish a DMARC policy, align the From domain, offer one-click unsubscribe for marketing emails and process unsubscribes promptly, and keep spam complaint rates low, below 0.3% and ideally below 0.1%. All senders are expected to have SPF or DKIM and valid DNS records.

Even if you send less, following these rules improves deliverability. Most email marketing tools support them; you need to add the DNS records.

Step-by-step setup

1. List every service that sends email for your domain: your mailbox provider, email marketing tool, invoicing software, help desk, CRM, website forms and online store.
2. Create or update your SPF record to include each service, in a single record.
3. Add DKIM records from each service's settings. Most tools show the exact records to copy.
4. Verify in each tool that SPF and DKIM pass.
5. Add a DMARC record with p=none and a reporting address.
6. Review DMARC reports for a few weeks to find any legitimate services you missed.
7. Tighten the policy to quarantine, then reject, once all legitimate email passes.

Where to add DNS records

DNS records are managed where your domain's nameservers point: often your domain registrar, your web host or a DNS service such as Cloudflare. Log in, find DNS settings, and add TXT or CNAME records as instructed. Changes can take minutes to hours to spread. If you are unsure where your DNS is managed, check your domain's nameservers. See how to choose a domain name and the web hosting ranking.

Reading DMARC reports

DMARC aggregate reports arrive as XML files listing which servers sent email using your domain and whether they passed SPF and DKIM. They are hard to read raw, so many businesses use a free or paid DMARC report service that turns them into dashboards. Look for legitimate services that fail, which you need to add to SPF or DKIM, and for unknown senders, which may be spoofing your domain.

Beyond authentication: reputation and engagement

Authentication is necessary but not enough. Inbox providers also watch how recipients respond. To keep a good reputation:

• Only email people who opted in.
• Send consistently rather than in sudden large bursts.
• Remove bounced and long-inactive addresses.
• Make unsubscribing easy, so people do not mark you as spam instead.
• Send content people want, so they open and click.

Our guide to email marketing for beginners covers list building and content.

Separate domains for marketing and cold email

Many businesses send marketing emails from a subdomain, such as news.yourbusiness.com, so that any reputation problems with marketing do not affect everyday email from the main domain. If you do cold outreach, use a separate domain or subdomain and keep volumes modest; cold email carries higher complaint risk. See AI for sales teams on why mass AI outreach harms deliverability.

Testing your setup

Send test emails to accounts at major providers and check the message headers for SPF, DKIM and DMARC results, usually shown as "pass". Many online tools check your DNS records and send-test results. Google Postmaster Tools shows your domain's reputation and spam rate for Gmail recipients if you send enough volume. Retest whenever you add a new sending service.

Fixing common problems

• Two SPF records: merge them into one.
• SPF lookup limit exceeded: remove unused services or use a flattening service.
• DKIM not verified: check the record name and value were copied exactly, without extra spaces.
• DMARC failing alignment: make sure the sending service uses your domain for DKIM signing, not its own.
• Emails in spam despite passing: look at engagement, list quality, content and sending volume.
• Forwarded emails failing SPF: DKIM usually survives forwarding, so make sure DKIM is set up.

Email tools and deliverability

Reputable email marketing tools guide you through authentication and monitor sending practices. Compare them in the email marketing ranking, Brevo vs MailerLite and Mailchimp vs Kit. For transactional emails from your website or app, use a service that supports DKIM on your domain. Protect the accounts that can send email with two-factor authentication, since a hacked email tool can destroy your domain reputation quickly.

Common mistakes

• Setting up SPF but not DKIM or DMARC.
• Multiple SPF records on one domain.
• Jumping straight to p=reject before checking reports, blocking legitimate email.
• Forgetting services such as invoicing or help desk tools that send as your domain.
• Sending marketing email from a free email address.
• Ignoring spam complaint rates.

Example: a small business with five sending services

A consultancy sends email from its mailbox provider, a newsletter tool, its invoicing software, its help desk and its website contact form. It had an SPF record that only included the mailbox provider, so invoices and newsletters sometimes landed in spam. It updated SPF to include the newsletter and invoicing services, added DKIM records for each of the four services that support custom DKIM, and configured the website form to send through the mailbox provider rather than the web server.

It then published a DMARC record with p=none and a reporting address. Reports showed one more service, a CRM sending meeting reminders, which it added. After a month of clean reports, it moved to p=quarantine, and later p=reject. Invoices now reliably reach clients' inboxes.

BIMI: your logo in the inbox

BIMI (Brand Indicators for Message Identification) lets some inbox providers display your logo next to authenticated emails. It requires DMARC at quarantine or reject, a properly formatted logo file, and for some providers a verified mark certificate. It is optional and mainly useful for brands with significant email volume, but it is a further reason to complete DMARC setup.

Transactional vs marketing email

Transactional emails, such as receipts, password resets and order updates, are expected by recipients and usually have high engagement. Marketing emails are more likely to be ignored or reported. Many businesses send them through different services or subdomains, so marketing issues do not affect important transactional mail. Whatever the setup, authenticate every service with SPF and DKIM, and make sure DMARC alignment passes.

Warming up a new domain

A brand-new domain or sending service has no reputation. If you suddenly send thousands of emails, providers may treat you with suspicion. Start with smaller volumes to your most engaged contacts, and increase gradually over several weeks. Monitor bounces, complaints and inbox placement as you scale. Many email marketing tools guide new senders through this.

A deliverability checklist

1. All sending services listed and included in one SPF record.
2. DKIM set up for each service on your domain.
3. DMARC published, reports reviewed, policy tightened over time.
4. Marketing sent from an authenticated domain or subdomain.
5. One-click unsubscribe in marketing emails.
6. Bounces removed and inactive subscribers re-engaged or removed.
7. Spam complaint rate monitored.

Protect your domain itself with strong registrar security; see how to protect a small business website.

When to get help

DNS changes can break email if done incorrectly, for example by deleting an existing SPF record or mistyping a DKIM value. If you are not comfortable editing DNS, ask your web developer, IT provider or domain registrar's support for help, and take a screenshot of existing records before making changes. Most email tools also have step-by-step guides for common DNS providers.

Questions