Email Deliverability Explained: SPF, DKIM and DMARC

You can write a brilliant email, design it beautifully and send it to a list of people who genuinely want it, and it can still end up in the spam folder. Very often the reason is not the content. It is that the receiving mail server could not confirm the email really came from you.

That confirmation is handled by three technical standards: SPF, DKIM and DMARC. They sound intimidating, but the ideas behind them are straightforward. This guide explains what each one does, how they fit together and what you should do next.

Why authentication matters

Email was designed decades ago without any built-in way to prove who sent a message. That gap is what makes phishing and spoofing possible: anyone can put your domain in the “from” line. Mailbox providers such as Gmail, Yahoo and Outlook therefore look for proof that a sender is legitimate before trusting their email.

In 2024, Google and Yahoo made this a firm expectation for anyone sending email in bulk to their users. Their requirements include authenticating email with SPF and DKIM, publishing a DMARC record, making it easy to unsubscribe (including one-click unsubscribe for marketing email) and keeping spam complaints low. Other providers are moving in the same direction. Even if you only send modest volumes, following these standards is now simply good practice.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a list, published in your domain’s DNS, of the servers that are allowed to send email on your behalf. When an email arrives, the receiving server checks whether it came from one of the approved sources.

A typical business might need to include:

• Its main email provider, such as Google Workspace or Microsoft 365.
• Its email marketing platform.
• Any other systems that send email as the domain, such as a CRM, helpdesk, booking tool or online shop.

A few practical points:

• You should have only one SPF record per domain. If you have two, merge them.
• SPF has a limit on the number of DNS lookups it can perform, so adding every tool you have ever used can break it. Remove services you no longer use.
• SPF checks the technical “envelope” sender, which is not always the address people see. That is one reason it is not enough on its own.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a digital signature to each email. Your sending platform signs the message with a private key, and you publish the matching public key in your DNS. The receiving server uses that public key to check that the signature is valid and that the message has not been altered on the way.

Most email platforms give you one or more DKIM records to add to your domain. The important thing is that the signature uses your domain, not just the platform’s. Many services sign with their own domain by default until you complete the custom setup, so check that this step has actually been done.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It does two jobs:

1. It checks alignment, meaning the domain that passed SPF or DKIM matches the domain in the visible “from” address.
2. It tells receiving servers what to do with email that fails, and asks them to send you reports.

A DMARC policy can be set to one of three levels:

• none: monitor only. Failing email is treated as normal, but you receive reports.
• quarantine: failing email should be treated as suspicious, usually by sending it to spam.
• reject: failing email should be refused outright.

A sensible rollout plan

Jumping straight to a strict DMARC policy can block your own legitimate email if you have missed a sending source. A safer approach is:

1. Audit your senders. List every system that sends email as your domain, including the ones people forget, such as invoicing software or website contact forms.
2. Set up SPF and DKIM for each of them, using your own domain.
3. Publish DMARC at p=none with a reporting address, and read the reports for a few weeks. They are hard to read raw, so a DMARC reporting tool helps.
4. Fix anything failing. Add missing senders or remove ones that should not be there.
5. Tighten gradually to quarantine and then, when you are confident, to reject.

This also protects your brand. A domain with a strict DMARC policy is much harder for criminals to spoof in phishing emails aimed at your customers.

Authentication is necessary, but not sufficient

Passing SPF, DKIM and DMARC gets you through the door. Staying out of spam also depends on your behaviour as a sender:

• Send to people who asked for it. Purchased lists and old, unengaged contacts lead to complaints and bounces.
• Make unsubscribing easy. If people cannot leave quickly, they press the spam button instead.
• Remove hard bounces and regularly re-engage or remove long-term inactive subscribers.
• Be consistent. Sudden large spikes in volume from a quiet domain can look suspicious.
• Watch your reputation. Tools such as Google Postmaster Tools show how Gmail views your domain.

Quick checks you can do today

• Send a test email to a Gmail address, open it and use “Show original” to see whether SPF, DKIM and DMARC passed.
• Look up your domain with a free DNS checking tool to confirm you have one SPF record and a DMARC record.
• Confirm your marketing platform is signing with your domain, not only its own.

Key takeaways

• SPF lists who can send for your domain, DKIM signs each message and DMARC sets the policy and reporting.
• Google and Yahoo’s 2024 requirements made authentication and easy unsubscribes an expectation for bulk senders.
• Roll out DMARC gradually, starting with monitoring.
• Good list habits matter as much as good DNS records.

If your emails are going missing or you are unsure whether your records are set up correctly, SEO Fleet’s email deliverability service can audit your domain, fix authentication issues and help you build sending habits that keep your emails in the inbox.