Deliverability
SPF, DKIM, and DMARC Explained for Non-Technical Business Owners
SPF, DKIM, and DMARC sound like alphabet soup, but they are the foundation of getting your email delivered, and of stopping scammers from impersonating your brand. As of 2024, Gmail and Yahoo require these for bulk senders. Here is what each does, in plain English.
SPF, who is allowed to send
SPF (Sender Policy Framework) is a DNS record that lists which mail servers are authorized to send email for your domain. When a server receives your message, it checks whether the sending server is on your approved list. Think of it as a guest list for your domain’s outgoing mail.
DKIM, proof the message was not tampered with
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email. The receiving server uses a public key in your DNS to verify the message genuinely came from your domain and was not altered in transit. It is like a tamper-proof seal on the envelope.
DMARC, what to do when checks fail
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving servers what to do if a message fails authentication, do nothing, quarantine it to spam, or reject it. It also sends you reports about who is sending mail using your domain, which surfaces impersonation attempts.
Why you need all three
- SPF alone can be spoofed in forwarded mail; DKIM survives forwarding.
- DKIM alone does not tell receivers what to do on failure; DMARC does.
- DMARC depends on SPF and DKIM being set up first.
- Together they prove identity, protect integrity, and define enforcement.
How to set them up
Your email or marketing platform provides the exact records to add to your domain’s DNS. Add the SPF and DKIM records they specify, then publish a DMARC record starting in “monitor” mode (p=none) to gather reports before tightening to quarantine or reject. If DNS is unfamiliar territory, this is a quick task for a technical partner.
Key takeaways
- ✓SPF lists who is allowed to send for your domain.
- ✓DKIM cryptographically proves the message was not altered.
- ✓DMARC sets enforcement and reports impersonation.
- ✓Gmail and Yahoo now require authentication for bulk senders.
- ✓Start DMARC in monitor mode, then tighten enforcement.
Valter Brandt
Chief Marketing Officer
Valter Brandt is the Chief Marketing Officer of ThisCom, working with clients across the United States and Europe. He has led marketing strategy through the major shifts in social advertising, mobile, content marketing, programmatic media, and marketing automation.
Frequently asked questions
Do I really need all three of SPF, DKIM, and DMARC?+
Yes. They work together, SPF authorizes senders, DKIM proves integrity, and DMARC sets enforcement and reporting. Gmail and Yahoo require all three for bulk senders, and missing any one weakens deliverability and security.
Where do I add SPF, DKIM, and DMARC records?+
They are TXT records added in your domain’s DNS settings (where your domain is registered or hosted). Your email or marketing platform gives you the exact values to paste in.
What does DMARC “p=none” mean?+
It is monitor mode: receivers still deliver mail normally but send you reports about authentication results. Use it to verify everything is configured correctly before moving to quarantine or reject enforcement.
Will setting these up stop people from spoofing my domain?+
A properly enforced DMARC policy (quarantine or reject) prevents most domain spoofing and protects your brand and customers from phishing that impersonates you.
Related articles
Email Deliverability: How to Stay Out of the Spam Folder
The best email in the world is worthless in the spam folder. Deliverability is infrastructure, here is how small businesses earn and protect inbox placement.
Read →Link BuildingToxic Backlinks: How to Find and Handle Them
Spammy or unnatural links can drag down your SEO. Here is how to identify toxic backlinks and what to do (and not do) about them.
Read →DeliverabilityTransactional vs. Marketing Email: What’s the Difference?
Order confirmations and newsletters follow different rules, infrastructure, and best practices. Confusing them hurts deliverability and can break the law.
Read →