Stop landing in spam: SPF, DKIM and DMARC in plain English
Anyone can type your address into the From line of an email. SPF, DKIM and DMARC are three DNS records that let receiving mail servers tell the real you from an imposter. Set them up and your mail is far more likely to reach the inbox.
What each one does
- SPF is a list of the servers allowed to send mail for your domain. It is a single TXT record. A domain may have only one.
- DKIM is a digital signature added to each message. The receiver checks it against a public key you publish in DNS. If the message was altered or not sent by you, it fails.
- DMARC is your instruction to receivers: what to do when mail claiming to be you fails, and where to send you reports. It also requires that the domain in the visible From address matches (aligns with) the SPF or DKIM domain.
Step 1: List everything that sends as you
Your mail provider, your newsletter tool, your invoicing app, your website contact form, your CRM. Each one must be covered by SPF or DKIM. Missing one is the most common cause of trouble.
Step 2: Set up SPF and DKIM
- Find your email provider's help page for SPF and DKIM. They give exact record values, which differ by vendor and sometimes by region.
- Publish one SPF record that includes every sender, and keep it under 10 DNS lookups.
- Turn on DKIM signing for your mail provider and for each other service that sends as you. Google recommends 2048-bit keys where possible.
- Send yourself a test to a Gmail account, open Show original, and look for SPF and DKIM both showing PASS.
Step 3: Roll out DMARC safely
Wait a couple of days after SPF and DKIM are working, then add a DMARC TXT record at _dmarc.yourdomain.com.
- Monitor (p=none):
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. Nothing is blocked. You receive daily reports of who is sending as you. Send reports to a dedicated mailbox, because they can be numerous. - Fix: read the reports for a few weeks. Any legitimate sender that fails gets its SPF or DKIM fixed.
- Quarantine (p=quarantine): failing mail goes to spam. Google suggests using the pct tag to start with a small percentage, such as
pct=10, and raising it over time. - Reject (p=reject): failing mail is refused. Only move here when the reports show your real mail passing.
You can stop at quarantine if reject feels risky. The right pace depends on how many services send as you.
What Google and Yahoo expect (2024 onward)
Since February 2024, Gmail has required more from anyone who sends more than 5,000 messages a day to Gmail accounts, and Yahoo has similar rules for bulk senders. In summary:
- SPF and DKIM both set up, and a DMARC record published (p=none is acceptable) with the From domain aligned.
- One-click unsubscribe on marketing mail, plus a visible unsubscribe link. Yahoo asks that requests be processed within two days.
- Spam complaint rates kept low. Google says stay under 0.10% and never reach 0.30%. Yahoo says under 0.3%.
- Valid forward and reverse DNS for sending servers, and TLS.
Even if you send far fewer messages, these are a good baseline, since Google says smaller senders need at least SPF or DKIM.