· 4 min read · by Matthew Rissik
SPF, DKIM and DMARC explained
SPF, DKIM and DMARC sound like three robots from a children’s show. They’re actually the reason some of your emails land in spam and your competitor’s don’t.
Here’s SPF, DKIM and DMARC explained without the jargon, plus what Gmail now requires and what to check today. (No DNS degree needed. I promise.)
tl;dr
SPF, DKIM and DMARC are three DNS records that prove your emails really come from you. SPF lists the servers allowed to send for your domain. DKIM adds a signature that proves the message wasn’t changed. DMARC tells inboxes what to do when a message fails those checks. Without them, more of your email lands in spam.
The three records, in plain English
| Record | What it does | Everyday version |
|---|---|---|
| SPF | Lists the mail servers allowed to send email for your domain | The guest list at the door |
| DKIM | Adds a digital signature that proves the email wasn’t altered | A wax seal on the envelope |
| DMARC | Tells inboxes what to do if SPF or DKIM fails, and sends you reports | The bouncer’s instructions |
All three live in your domain’s DNS settings, wherever your domain is managed. Your email provider gives you the exact values. Google Workspace has step-by-step guides for SPF, DKIM and DMARC, and most other providers publish the same.
Why it matters: spam folders and spoofing
Inbox providers have one question about every email: is this really from who it says it’s from? If your domain can’t answer, your invoices, quotes and replies are more likely to end up in spam. Nobody tells you. The client just “never got it.”
The second reason is spoofing. Without these records, it’s easier for someone else to send email pretending to be your domain, to your clients, asking them to pay a new bank account. That’s a very bad day for everyone, mostly the client.
What Gmail now requires
Gmail’s sender guidelines set the rules. Every sender should set up SPF or DKIM. If you send more than 5,000 messages a day to Gmail accounts, you need SPF, DKIM and DMARC, the From address must line up with your SPF or DKIM domain, and marketing messages need one-click unsubscribe.
Gmail also watches complaints. It asks senders to keep spam rates reported in Postmaster Tools below 0.30%, and recommends staying under 0.10%. In plain English: if too many people hit “report spam,” everything you send suffers.
If you send cold email, this is the foundation
Never send cold email from your main domain. Set up a separate sending domain, give it its own SPF, DKIM and DMARC, and warm it for several weeks before a campaign goes out. Burn a secondary domain and it’s an inconvenience. Burn your main one and your invoices stop landing.
This is the least exciting part of outbound and the part that decides whether anything else works. A perfect email in a spam folder has a reply rate of zero. (Copywriting is more fun than DNS records. It’s also useless until the DNS records are right.)
Rolling out DMARC without breaking your email
DMARC has settings from “just report” to “reject anything that fails.” Jumping straight to the strict end can block your own legitimate email: the newsletter tool, the CRM, the invoicing system that sends on your behalf.
The safe order: start in monitoring mode, read the reports for a few weeks, make sure every tool that sends as your domain is covered by SPF or DKIM, then tighten the policy step by step.
What I’d do this week
Send an email from your business address to a Gmail account, open it, choose “Show original,” and look for SPF, DKIM and DMARC. Each should say PASS. If any say FAIL or are missing, send the result to whoever manages your domain. It’s often a quick fix for someone who knows where to click.
If you’re planning cold email, set up the separate sending domain now, since it needs weeks to warm. Then read how to write a cold email that gets replies. Or if you’d rather it was all handled, that’s part of my outbound lead generation setup.
If you want a second pair of eyes on yours, book a call and I’ll tell you honestly what I’d change first.
Questions people ask
What is SPF in email?
A DNS record that lists the mail servers allowed to send email for your domain. Inboxes check it to spot forged senders.
What is DKIM?
A digital signature added to your emails that proves they came from your domain and weren’t changed along the way.
What is DMARC?
A DNS record that tells inboxes what to do when an email fails SPF or DKIM, and sends you reports so you can see who is sending as your domain.
Why are my emails going to spam?
Missing or broken SPF, DKIM or DMARC is a common cause. High spam complaints, sending from a new domain too fast, and spammy content are others.
Does Gmail require DMARC?
For senders of more than 5,000 messages a day to Gmail accounts, yes. All senders should at least set up SPF or DKIM.
Keep reading
if you’ve got another minute