Email Deliverability (SPF, DKIM, DMARC)
Email authentication records are DNS settings that prove you are authorized to send email from your domain. Setting up all three is critical for inbox placement.
SPF (Sender Policy Framework):
- Specifies which mail servers can send email on behalf of your domain
- DNS record type: TXT record on your root domain
- Example: v=spf1 include:_spf.google.com ~all
- Check with your email provider for the correct 'include' value
DKIM (DomainKeys Identified Mail):
- Adds a cryptographic signature to your emails to verify they haven't been tampered with
- DNS record type: TXT or CNAME record (provider-specific subdomain)
- Your email provider generates the DKIM key — check their documentation
- Google Workspace: Admin Console > Apps > Gmail > Authenticate Email
- Microsoft 365: Microsoft 365 Defender > Email & Collaboration > Policies
DMARC (Domain-based Message Authentication, Reporting & Conformance):
- Tells receiving servers what to do with emails that fail SPF or DKIM checks
- DNS record type: TXT record at _dmarc.yourdomain.com
- Start with: v=DMARC1; p=none; rua=mailto:[email protected]
- 'p=none' monitors only (recommended to start). Upgrade to 'p=quarantine' then 'p=reject' over time.
Verification:
- Open Mailboxes (or Analytics > Mailboxes) to see the SPF, DKIM and DMARC status for each sending domain. Hover any badge for the full explanation.
- Valid — the record is published and reads correctly.
- Missing — we looked and found no valid record. This is the one to act on.
- Not checked — we have not looked yet. Run Test Connection on the mailbox and we will check it.
- On bounce domain (SPF only) — some providers send using their own bounce domain, and your SPF record is published there rather than on your sending domain. That bounce domain is what SPF is checked against for your mail, so there is nothing to add on the sending domain itself. This is a correct setup, not a problem.
- Signing confirmed (DKIM) — the strongest result. It means we can see your mail actually being signed as it goes out, checked on real mail you sent rather than on a records lookup. Nothing to do.
- DKIM can show Not checked even when DKIM is working fine. The signature is published under a name only your email provider knows, and we will not guess at it. Your provider's dashboard will confirm whether it is switched on, and once you have been sending for a little while we can usually confirm it for you automatically.
Common DNS Providers:
- GoDaddy, Namecheap, Cloudflare, Google Domains, Route 53 (AWS)
- Each has a slightly different interface for adding TXT records
- Changes can take 24-48 hours to propagate
Impact: Domains with all three records properly configured see significantly higher inbox placement rates (80%+ vs. 40-60% without).