Email deliverability basics: SPF, DKIM and DMARC explained

Email was designed without proof of identity. Anyone can put your address in the From line, which is why phishing works. Inbox providers such as Gmail, Outlook and Yahoo protect users by checking whether each message is authenticated, and by watching how recipients respond to mail from each sender.

A business that adds an email marketing tool, a CRM, a helpdesk and an invoicing system often ends up with several services sending as its domain — and nobody updates the DNS to authorise them. To a receiving server, each unauthorised service looks a little like an impersonator.

Reputation does the rest. Bought lists, mailing people who never opted in and sending too often all generate complaints and low engagement, which push future mail toward spam even when authentication is perfect.

A typical record looks like v=spf1 include:_spf.google.com include:sendgrid.net ~all. Each include authorises a service, and the ending says what to do with everyone else: ~all marks other senders as suspicious (a soft fail), while -all tells receivers to reject them.

Two rules trip people up. A domain must have only one SPF record — two separate records break SPF, so merge them. And SPF allows at most ten DNS lookups; every include counts, and some includes trigger more. Exceed the limit and SPF fails.

SPF checks the technical envelope sender, which is not always the address people see. That gap is why DKIM and DMARC exist.

Each sending service — Google Workspace, Microsoft 365, your email marketing platform, your CRM — has its own key. You publish the public part as a DNS record under a selector name the service gives you, then switch on signing in that service’s settings.

The step most often missed is the last one: publishing the record but never switching signing on, or leaving a marketing tool signing with its own domain instead of yours. For DMARC to pass on DKIM, the signature must use your domain or one aligned with it.

Use 2048-bit keys where the service supports them, and keep a note of which selector belongs to which service, so you can remove old keys when you stop using a tool.

A starter record looks like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. It publishes a monitor-only policy and asks inbox providers to send aggregate reports to that address. The reports show every service sending as your domain and whether it passes.

Alignment is the key idea. DMARC passes only if SPF or DKIM passes and the domain it checked matches the domain in the visible From address. That is what stops someone sending ‘from’ your domain through their own server.

Read the reports for a few weeks, fix any legitimate service that fails, then move to p=quarantine and eventually p=reject. A DMARC reporting tool turns the raw XML into something readable; many have a free tier.

Google treats senders of close to 5,000 or more messages a day to personal Gmail accounts as bulk senders, and a domain keeps that status once it qualifies. The basics apply to everyone, though: Google asks all senders for SPF or DKIM, valid forward and reverse DNS, and a secure (TLS) connection.

Google publishes a spam-rate threshold in its sender guidelines and shows your rate in Postmaster Tools. Check the current figures there, as enforcement has tightened over time and the details can change.

Even well below bulk volumes, meeting the bulk standard is the safest default. It costs little, and it means your quotes and invoices arrive with the same credibility as your newsletters.

Only email people who asked to hear from you, remove addresses that bounce, and stop mailing people who have not opened anything for months. A smaller, engaged list usually reaches the inbox more reliably than a large, tired one.

Separate your streams. Send marketing email from a subdomain such as news.yourdomain.com and keep transactional and personal mail on the main domain, so a newsletter complaint spike does not drag down invoice delivery.

Keep content plain and honest: a recognisable sender name, a subject that matches the body, a working unsubscribe link and a postal address where the law requires one. Image-only emails and link shorteners tend to attract filtering.