Guide, CRM
What are SPF, DKIM and DMARC in email marketing?
- Author
- PureField
- Published
- Updated
SPF, DKIM and DMARC are three records added to your domain's DNS. SPF says which servers may send email on your behalf, and DKIM shows the message was not changed in transit. DMARC tells the receiver what to do when those checks fail. Gmail and Yahoo require all three from anyone sending thousands of emails a day.
Why do you need all three?
You need all three because each one answers a different question. SPF checks the sending server, DKIM checks the content, and DMARC ties both results to the visible "From" address and sets a policy. A domain with SPF alone can still be spoofed.
| Record | What it proves | Where it lives and what it looks like | Common mistake |
|---|---|---|---|
| SPF | This server may send for this domain | TXT record on the domain: v=spf1 include:_spf.provider.com ~all | Publishing two SPF records or going over the 10 DNS lookup limit |
| DKIM | The email was signed and not altered in transit | TXT record at selector._domainkey.company.com: v=DKIM1; k=rsa; p=... | Mistyping or leaving out the selector your sending provider gave you |
| DMARC | The "From" domain aligns with SPF or DKIM; if not, this policy applies | TXT record at _dmarc.company.com: v=DMARC1; p=none; rua=mailto:dmarc@company.com | Jumping straight to p=reject without reading any reports |
How do you set up SPF?
You add a single TXT record to your domain and list every service that sends email for you. If you have a company mail server, a marketing sending service and a system that emails invoices, all three belong in that one record.
Two rules matter:
- A domain has exactly one SPF record. Add a second v=spf1 record and the check fails.
- An SPF check may make at most 10 DNS lookups. Every include, a, mx and redirect counts. Keep adding services and you go over the limit, which makes SPF invalid.
At the end of the record, ~all means "treat anything not listed with suspicion" and -all means "reject anything not listed".
How do you set up DKIM?
For DKIM you publish the public key your sending service gives you in DNS. The service signs every outgoing email with its private key, and the receiving server checks the signature against the public key in DNS. The "selector" in the record's name lets one domain hold several keys, so each sending service gets its own selector.
How do you choose a DMARC policy?
Start DMARC at p=none and tighten it once you have read the reports. The usual order is:
- p=none: Nothing is blocked; you only get reports. You see which services send on your behalf.
- p=quarantine: Mail that fails goes to the spam folder.
- p=reject: Mail that fails is rejected.
The rua address receives daily aggregate reports from receiving servers. If a report shows a service you forgot to add to SPF, fix it before you tighten the policy.
DMARC passes only with "alignment": the domain in the "From" field must match the domain SPF checked or the domain in the DKIM signature.
What do Gmail and Yahoo require from senders?
Since February 2024, Gmail and Yahoo have required authentication and easy unsubscribe from bulk senders. Google defines a bulk sender as one that sends close to 5,000 or more messages a day to personal Gmail accounts.
- Both SPF and DKIM must be in place.
- A DMARC record with at least p=none, and the "From" domain aligned with SPF or DKIM.
- Marketing email must offer one-click unsubscribe, and requests must be honoured within two days.
- The rate of users marking your mail as spam must stay below 0.3%.
Smaller senders still need SPF or DKIM. Check the sources below for the current rules.
How are these records set up in PureField Marketing?
In PureField Marketing email settings, SPF, DKIM and DMARC are set up step by step, and the screen shows which record to add to your DNS. Every email goes through a 39-point content check before it is sent. The list health screen shows the state of a segment, and addresses on the block list are never sent to. Email goes out over SMTP, Postmark or Mandrill.
Correct records are the foundation of delivery. Along with them, list quality, content and how recipients react decide the outcome.
Evidence
- SPF
- The record format and the 10 DNS lookup limit are defined in RFC 7208.
- DKIM
- The signature and selector structure are defined in RFC 6376.
- DMARC
- Policy, alignment and the report address are defined in RFC 7489.
- Gmail requirements
- The bulk sender definition and authentication rules are in Google's email sender guidelines.
- Yahoo requirements
- Yahoo's sender rules are on Yahoo Sender Hub.
Book a PureField Marketing demo to see domain setup and the content check. Book a demo
Frequently asked questions
Which comes first: SPF, DKIM or DMARC?
Set up SPF and DKIM first, then add DMARC at p=none once both work. If the reports stay clean for a few weeks, move the policy to quarantine, then reject.
How many SPF records can a domain have?
One. With two, the check fails, so you combine all your sending services in a single record.
Is DMARC p=none enough?
It meets the minimum Gmail and Yahoo set for bulk senders. Protection against spoofing starts at quarantine or reject.
What else decides delivery besides these records?
The records prove the email comes from you. Delivery also depends on list quality, content and spam complaint rates; in PureField Marketing, the list health screen and the 39-point content check before each send look after that side.