Why It Matters
Without authentication, anyone can send email pretending to be your domain. That's not just a security problem — it tanks your deliverability. Mailbox providers like Gmail and Outlook now require at least SPF and DKIM to even consider putting your messages in the inbox. Google started enforcing this for bulk senders in February 2024, and other providers quickly followed.
The Three Pillars
SPF (Sender Policy Framework)
SPF is non-negotiable. Without it, receiving servers have no way to verify that you're actually authorized to send from your domain. You publish a DNS TXT record listing every IP address and service allowed to send on your behalf. When a server gets your email, it checks that list. If the sending IP isn't there, it's a red flag.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every email you send. The receiving server uses your public key (published in DNS) to verify the signature matches. This proves two things: the email genuinely came from your domain, and nobody tampered with it in transit.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC ties SPF and DKIM together and tells receivers what to do when authentication fails. You can set your policy to "none" (just monitor), "quarantine" (send to spam), or "reject" (block entirely). Start with "none" so you can review reports before tightening things up.
Common Mistakes
- Setting DMARC to "reject" before you've confirmed all legitimate sending sources pass SPF and DKIM — this blocks your own emails
- Forgetting to add third-party services (like your CRM or helpdesk) to your SPF record
- Exceeding the 10 DNS lookup limit in SPF, which silently breaks authentication
- Never checking DMARC aggregate reports — they're the only way to spot unauthorized senders using your domain
How to Set It Up
Start with SPF. Add a TXT record to your domain's DNS that includes every service you send from. Then set up DKIM through each sending platform — most ESPs generate the keys for you. Finally, add a DMARC record starting with p=none and an email address for reports. Monitor those reports for 2–4 weeks, fix any gaps, then move to p=quarantine and eventually p=reject.
Quick Tips
- Use a DMARC monitoring tool — the raw XML reports are nearly unreadable
- Audit your SPF record quarterly to remove services you no longer use
- Enable BIMI after you hit DMARC enforcement — it displays your logo in supported inboxes