Three tools, one job: prove your mail is really from you
You keep seeing the same three names. SPF, DKIM, DMARC. They show up in setup guides, in bounce messages, in that email from IT you never finished reading. And your mail keeps landing in spam or getting flat-out filtered, and nobody told you plainly why. This is the plain version. Three tools, one job: prove your mail is really from you. Get them right and providers stop treating you like a stranger.
What SPF, DKIM, and DMARC each do
SPF, DKIM, and DMARC are three DNS records that prove who is sending mail for your domain. SPF lists which servers are allowed to send as you. DKIM adds a signature that proves the message was not changed in transit. DMARC ties both together and tells receiving servers what to do when a message fails: let it through, hold it, or reject it. Without them, a receiver cannot confirm you are you, so it filters you to be safe.
Why this matters for your wallet
Every message that gets filtered is money that never arrives. Providers like Gmail and Yahoo now expect authentication, and bulk senders without it get quietly held back or bounced. This is not a compliance checkbox. It is the difference between your campaign reaching people and your campaign disappearing. Set it once, done right, and you stop paying that tax on every send.
SPF: which servers may send for you
Think of SPF as the guest list at the door.
You publish a short record in your DNS that names the servers allowed to send email using your domain. Your marketing platform, your CRM, your own mail server, whatever you actually send through. When a message arrives, the receiver checks the sending server against your list. On the list, it passes. Not on the list, it fails, and a stranger claiming to be you just got caught.
The analogy: a bouncer with a guest list. Name is on the list, you walk in. Name is not, you do not.
What it looks like, conceptually:
your-domain.com TXT "v=spf1 include:your-sending-platform.com include:your-crm.com -all"That says: mail from these named sources is legit, and anything else should be rejected. You do not need to memorize the syntax. You need to know that every service you send through must be listed, or its mail can fail.
The common mistake: you start sending through a new tool and forget to add it to SPF. Now your own mail fails your own guest list.
DKIM: a signature that proves nothing was tampered with
SPF says the right server sent it. DKIM proves the message itself was not altered on the way.
Your sending server stamps each outgoing message with a cryptographic signature. The matching public key sits in your DNS. The receiver reads the signature, checks it against the key, and confirms two things: this really came from your domain, and the content was not changed in transit. If someone intercepted the message and edited it, the signature breaks and the check fails.
The analogy: a wax seal on an envelope. If the seal is intact, nobody opened and rewrote the letter. If it is cracked, you know not to trust what is inside.
What it looks like, conceptually:
selector._domainkey.your-domain.com TXT "v=DKIM1; k=rsa; p=long-public-key-string"Your sending platform gives you this record and the private key stays on their side. You publish the public half in DNS and DKIM starts signing. From then on, receivers can verify your mail has not been forged or edited.
DMARC: the policy that ties it all together
SPF and DKIM each answer a question. DMARC decides what happens with the answer.
DMARC is a record that does three things. It links SPF and DKIM to the domain your reader actually sees in the "From" line, so a scammer cannot pass a check on some throwaway domain while wearing your name. It tells receivers what to do when a message fails: do nothing, quarantine it to spam, or reject it outright. And it sends you reports, so you can see who is sending mail as you, including anyone trying to impersonate you.
The analogy: the manager standing behind the bouncer. The bouncer checks the list (SPF) and the seal (DKIM). The manager sets the house rule for anyone who fails, and reads the nightly log of who tried to get in.
What it looks like, conceptually:
_dmarc.your-domain.com TXT "v=DMARC1; p=reject; rua=mailto:reports@your-domain.com"That p= is the policy. p=none means monitor only, p=quarantine sends failures to spam, p=reject refuses them. Most senders start at none to watch the reports, then tighten to quarantine and reject once they know their real mail passes.
What a passing setup looks like
Here is the whole picture in one glance.
| Record | The question it answers | Pass means |
|---|---|---|
| SPF | Did an allowed server send this? | The sending server is on your list |
| DKIM | Was the message left untouched? | The signature matches, content is intact |
| DMARC | What do we do on a fail, and does the "From" match? | Alignment holds, policy is applied, reports go out |
When all three pass and align, a receiver has real proof you are you. That does not force your mail into the inbox, but it clears the biggest reason a legitimate sender gets filtered: nobody could confirm your identity.
How to check yours pass
You do not have to guess.
- Send yourself a test. Mail one of your own campaigns to a personal Gmail or Outlook address.
- Open the raw headers. In Gmail, "Show original." This tells you PASS or FAIL for SPF, DKIM, and DMARC in plain text. Our walkthrough on how to read email headers shows you exactly where to look.
- Run a basic check. Plenty of free lookups will read your published SPF, DKIM, and DMARC records and flag what is missing or malformed.
- Read your DMARC reports. Once DMARC is live, the reports show every source sending as you. That is how you catch a tool you forgot to authorize, or someone spoofing your name.
If all three say PASS and your "From" domain aligns, your authentication is doing its job.
What a fail costs you
A failing setup does not always bounce loudly. Often it just quietly costs you.
- Legitimate mail gets held, filtered, or dropped, and you never see the ones that vanished.
- Bulk sending to major providers gets throttled or rejected outright.
- Scammers can send mail wearing your domain, and your reputation takes the hit for their behavior.
- You look like every other unverified stranger, so you get treated like one.
Fixing authentication is a one-time job with a lasting payoff. It is the cheapest reputation win available.
Authentication proves who sends, not who you send to
Here is the part most authentication guides skip.
SPF, DKIM, and DMARC all prove one thing: who is sending. That is the whole job. Not one of them says a word about who you are sending to.
And that is the other half of your reputation. You can pass every check, align every record, and still torch your sender rep by mailing dead addresses and spam traps. Perfect authentication on a dirty list is a sealed envelope sent to a graveyard. The provider knows it is really you. It just watches you bounce and hit traps, and it slows you down anyway.
That second half is the half Listgevity owns. Run your list through and every address comes back with a plain verdict: Inbox the good ones, Caution the risky ones, Remove the dead. Authentication proves you are you. A clean list keeps that proven-good name worth trusting. You need both, and a clean sender stays clean.
A basic check tells you the mailbox exists. We tell you whether sending to it makes you money or wrecks the reputation you just worked to authenticate.
FAQ
Do I really need all three? Yes. SPF and DKIM each prove one thing, and DMARC is what ties them to your visible "From" and sets the rule on a fail. Major providers now expect the full set from bulk senders. Skip one and you leave a gap a receiver has to fill by guessing, and guessing usually means filtering.
Will passing SPF, DKIM, and DMARC guarantee I hit the inbox? No, and be careful with anyone who says it will. Authentication removes a major reason good mail gets filtered, but the inbox is earned by your whole sending behavior. Nobody can promise placement. What you can do is clear every avoidable reason to be filtered, and authentication plus a clean list clears the two biggest ones.
What is the difference between SPF and DKIM? SPF checks the sending server against a list of who is allowed. DKIM checks a signature that proves the message content was not changed. One is about the sender's identity, the other is about the message's integrity. DMARC uses the results of both.
Should I set DMARC to reject right away? Usually not on day one. Start at p=none to monitor, read the reports until you are sure all your real mail passes, then tighten to quarantine and finally reject. Jump straight to reject before you have checked, and you risk blocking your own legitimate mail.
I authenticated everything and my mail still gets filtered. Why? Authentication is only half the story. If you are mailing dead addresses, catch-alls, and traps, your reputation drops no matter how clean your records are. Check your list next. A blacklist check and a full Inbox / Caution / Remove pass on your addresses will usually surface what authentication cannot.