SPF, DKIM, and DMARC: The Complete Setup Guide
SPF, DKIM, and DMARC: The Complete Setup Guide
If you send email in 2026 without proper authentication, you are fighting an uphill battle. Gmail and Yahoo now expect bulk senders to publish SPF, DKIM, and DMARC—and enforce them strictly.
This guide walks through each protocol, how they work together, and how to configure them without the guesswork.
Why Authentication Matters
Authentication tells receiving mail servers that your messages are authorized and unmodified. Without it:
- Messages may be rejected or quarantined
- Phishers can spoof your domain more easily
- Your brand reputation suffers even when you did nothing wrong
Think of SPF, DKIM, and DMARC as three layers of identity verification—not interchangeable, but complementary.
SPF (Sender Policy Framework)
SPF publishes which IP addresses and services may send email on behalf of your domain.
How to set up SPF
- Choose a sending subdomain (recommended):
mail.yourdomain.com - Create a TXT record at that subdomain or root domain
- Include your ESP's SPF mechanism
Example record:
v=spf1 include:spf.sprintmailer.com ~all
Common SPF mistakes:
- Exceeding the 10-DNS-lookup limit (too many
include:statements) - Using
+all(never do this) - Publishing SPF only on the root domain while sending from a subdomain
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to each message. Receiving servers verify the signature against a public key in your DNS.
How to set up DKIM
- Generate a key pair in your ESP dashboard
- Publish the public key as a TXT record (usually
selector._domainkey.yourdomain.com) - Send a test message and confirm the signature passes
SprintMailer rotates selectors and validates DKIM alignment automatically, so your From domain and signing domain stay matched.
DMARC (Domain-based Message Authentication)
DMARC tells receivers what to do when SPF or DKIM fails, and sends you aggregate reports about authentication results.
Recommended rollout
| Phase | Policy | Duration |
|-------|--------|----------|
| Monitor | p=none | 2–4 weeks |
| Quarantine | p=quarantine | 4–8 weeks |
| Reject | p=reject | Ongoing |
Example record:
v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100
Review DMARC aggregate reports weekly. They reveal unauthorized senders, misconfigured third-party tools, and alignment failures you would otherwise miss.
Alignment: The Hidden Requirement
Gmail requires alignment—your From domain must align with either the SPF domain or DKIM signing domain. Misalignment is one of the most common reasons authenticated mail still fails bulk sender requirements.
Use separate subdomains for marketing (news.yourdomain.com) and transactional (mail.yourdomain.com) to protect critical messages if marketing reputation dips.
Troubleshooting Checklist
- [ ] SPF record resolves and includes all sending sources
- [ ] DKIM signature passes on test messages
- [ ] DMARC policy published with valid reporting address
- [ ] From domain aligns with SPF or DKIM domain
- [ ] Third-party tools (CRM, helpdesk) included in SPF
Next Steps
Authentication is the foundation of every deliverability program. Once SPF, DKIM, and DMARC are correct, you can focus on list quality, content, and monitoring with confidence.
Set up authentication with SprintMailer or read our deliverability service overview.