SPF, DKIM and DMARC Explained Without the Jargon
Three DNS records decide whether your cold emails reach the inbox. What each one does, how to check yours and what to fix first.
You can write the perfect cold email and still land in spam. Before an inbox reads a word, it checks whether the message really came from you. Three DNS records answer that question: SPF, DKIM and DMARC.
You set them up once, and they help every email you send.
The short version
- SPFSPFA DNS record listing which servers are allowed to send email for your domain. lists who is allowed to send email for your domain.
- DKIMDKIMAn email signature that proves a message came from your domain and was not changed on the way. signs each email so the inbox can tell it was not changed.
- DMARCDMARCA DNS policy telling inboxes what to do with mail that fails SPF or DKIM checks. tells inboxes what to do when the first two checks fail.
Think of it as a guest list, a wax seal and a house rule for anyone who shows up without either.
SPF: the guest list
SPF is a single text record on your domain that names the services allowed to send as you: your email provider, your CRM, your newsletter tool.
When an email arrives, the inbox checks whether the sending server is on the list. If not, the email looks suspicious.
Common problems:
- no SPF record at all,
- two SPF records instead of one (only one is allowed),
- a tool you send from is missing from the list.
DKIM: the seal
DKIM adds a hidden signature to every email. The matching key sits in your DNS. The inbox uses it to confirm the email came from your domain and was not edited on the way.
Your email provider generates the key; you publish it. Turn it on for every service that sends as you, not just your main inbox.
DMARC: the house rule
DMARC connects SPF and DKIM to the address people actually see in the From line, and tells inboxes what to do when checks fail:
| Policy | What happens to failing email |
|---|---|
p=none |
Delivered, but you get reports |
p=quarantine |
Sent to spam |
p=reject |
Blocked |
Start with p=none to see what is sending as you. Move to quarantine once the reports look clean.
How to check yours
Look up your domain in any free DNS checker and confirm:
- exactly one SPF record that includes every tool you send from,
- DKIM enabled and passing for your main email provider,
- a DMARC record, even if it only says
p=nonefor now.
Then send an email to a personal Gmail address, open it and choose "Show original". You should see SPF, DKIM and DMARC all marked as passing.
Beyond the records
These records get you through the door. Staying there depends on your sender reputationSender reputationHow much inbox providers trust your domain, based on bounces, complaints and engagement.: keep your bounce rateBounce rateThe share of sent emails that could not be delivered. low, warm upEmail warm-upGradually increasing sending volume on a new domain so inboxes learn to trust it. new domains slowly and send to people who are likely to care.
