SPF, DKIM, and DMARC (SPF DKIM DMARC)
In short
SPF, DKIM, and DMARC are email authentication standards set up as DNS records on your sending domain. Together they let receiving servers verify that a message really comes from you and tell them what to do when a check fails.
For outbound teams, these records are the foundation of deliverability. Major mailbox providers expect them, and unauthenticated cold email is far more likely to be filtered or rejected.
What each record does
SPF (Sender Policy Framework)
SPF is a list of servers allowed to send email for your domain. The receiving server checks whether the sending server is on that list.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to each message. The receiver uses a public key published in your DNS to confirm the message was not altered and was signed by your domain.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC builds on the other two. It tells receivers whether to accept, quarantine, or reject mail that fails checks, and it sends you reports about who is sending as your domain.
How to set them up
Do this for every domain and subdomain you send from, including those used for outreach.
- Step 1: List every tool that sends email for the domain: your mailbox provider, sales engagement platform, marketing platform, and support desk.
- Step 2: Publish one SPF record that includes all of them. A domain should have only a single SPF record.
- Step 3: Enable DKIM signing in each sending tool and add the keys it provides to your DNS.
- Step 4: Publish a DMARC record, starting with a monitoring-only policy so you can read reports without blocking mail.
- Step 5: Once reports show legitimate mail passes, move gradually to a stricter policy.
Common mistakes
- Publishing two SPF records, which causes SPF to fail.
- Adding a new sending tool without updating SPF and DKIM.
- Jumping straight to a strict DMARC policy and blocking your own legitimate mail.
- Assuming authentication guarantees inbox placement. It is required, but reputation and content still matter.
- Setting up records on the main domain but not on separate outreach domains.
How to check that it works
Send a test email to a mailbox you control and view the original message headers. They show pass or fail results for SPF, DKIM, and DMARC. Re-check after any change to your sending tools.
Authentication vs. reputation
These records prove who you are. Sender reputation reflects how recipients treat your mail over time. You need both for reliable delivery, and authentication is the one you can fix in an afternoon.
SPF, DKIM, and DMARC FAQs
What is the difference between SPF, DKIM, and DMARC?
SPF lists the servers allowed to send for your domain. DKIM signs each message so receivers can confirm it was not altered. DMARC ties them together, sets what happens when checks fail, and sends you reports about mail using your domain.
Do I need SPF, DKIM, and DMARC for cold email?
Yes. Major mailbox providers expect authenticated mail, especially from senders with higher volume. Without these records your cold emails are far more likely to be filtered or rejected, and you lose visibility into misuse of your domain.
How do I check if SPF, DKIM, and DMARC are set up correctly?
Send an email to a mailbox you control and read the original message headers, which show pass or fail for each check. You can also use a DNS lookup tool to view your published records for errors.
What DMARC policy should I start with?
Start with a monitoring-only policy, often called none. It lets you receive reports without affecting delivery. After confirming legitimate sources pass, you can move to quarantine and then reject if appropriate.
