SPF (Sender Policy Framework)
A DNS record listing which mail servers may send email for your domain. When an email arrives, the receiving server checks whether it came from an allowed server.
Example idea: "Emails from my domain may come from Google Workspace and my sending tool."
DKIM (DomainKeys Identified Mail)
A digital signature added to each email. The receiving server checks it against a public key in your DNS. If the signature matches, the email hasn't been altered and really came from your domain.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
A policy that tells receivers what to do when SPF or DKIM checks fail — do nothing (none), send to spam (quarantine) or reject — and where to send reports.
Why they matter
Major inbox providers expect authenticated email, and bulk-sender requirements make them mandatory for higher volumes. Without them, emails are more likely to land in spam or be rejected.
How to set them up
- In your email provider, find the SPF and DKIM values for your domain.
- Add them as DNS records at your domain registrar.
- Add a DMARC record, starting with a monitoring policy (p=none) and a reporting address.
- Check everything with a DNS or email-testing tool.
- Tighten DMARC to quarantine or reject once reports look clean.
For cold email
Set these up on every sending domain before warm-up starts. See warming up a domain.
Example
An email claims to come from yourbrand.com. The receiving server checks SPF (was it sent from an allowed server?), checks DKIM (is the signature valid?), then applies your DMARC policy if either fails — for example, sending it to spam.
Key takeaways
- SPF lists allowed senders; DKIM signs emails; DMARC sets the policy.
- Set all three up on every sending domain.
- Start DMARC at "none", then tighten it.