Pricing

Deliverability guide

SPF, DKIM and DMARC, explained in plain English

Three DNS records decide whether mailbox providers believe your email really comes from you. Here is what each one does, how they work together and how to set them up for email marketing.

Updated

Why they matter now

Since February 2024, Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM, publish a DMARC policy, offer one-click unsubscribe and keep spam complaints low. Gmail’s threshold for bulk senders is 5,000 messages a day to Gmail addresses, and Microsoft announced similar requirements for Outlook.com in 2025. Even well below those volumes, authenticated email is far more likely to reach the inbox.

SPF: which servers may send for your domain

SPF is a TXT record that lists the servers allowed to send email for a domain. Receivers check it against the envelope sender (the Return-Path or MAIL FROM address), not the From address people see. That is why a custom MAIL FROM subdomain on your own domain matters: it lets SPF line up with your brand.

bounce.yourbrand.com  TXT  "v=spf1 include:amazonses.com ~all"
  • Publish only one SPF record per host name; merge services into it instead of adding a second record.
  • SPF allows at most 10 DNS lookups; every include counts.
  • ~all (soft fail) is the usual choice for marketing domains; -all rejects everything not listed.

DKIM: a signature that proves the message wasn’t changed

DKIM signs every message with a private key held by the sending service. The matching public key sits in your DNS under a selector, such as abc123._domainkey.yourbrand.com. Receivers check the signature; if the message was altered on the way, it fails. With Amazon SES, DKIM is published as three CNAME records that point to keys Amazon rotates for you.

abc123._domainkey.yourbrand.com  CNAME  abc123.dkim.amazonses.com

DMARC: the policy that ties them together

DMARC tells receivers what to do when a message fails, and asks them to send you reports. A message passes DMARC when SPF or DKIM passes and the passing domain aligns with the domain in the From address.

_dmarc.yourbrand.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"
  1. 1 Start with p=none and read the aggregate reports for a few weeks to find every service sending as your domain.
  2. 2 Authenticate the services you recognise and retire the ones you don’t.
  3. 3 Move to p=quarantine, optionally with pct=25 to apply it to a share of failing mail first.
  4. 4 When reports stay clean, move to p=reject so nobody else can send as you.

Alignment, the part most guides skip

SPF and DKIM can pass for a sending provider’s domain while your From address shows yours. That passes SPF and DKIM but fails DMARC, because nothing aligns with your brand. Signing with DKIM on your own domain and using a MAIL FROM subdomain of your own domain fixes it.

How Sendonia sets them up

When you add a sending domain, Sendonia generates the records for you: one TXT record to prove ownership, three DKIM CNAME records, an MX and SPF record for the MAIL FROM subdomain, and a DMARC record. If your DNS provider supports Domain Connect, you can connect it and the records are added automatically. Sendonia keeps re-checking them afterwards.

Check your setup

  • Send a test to a Gmail address and open “Show original”: SPF, DKIM and DMARC should all say PASS.
  • Read your DMARC aggregate reports, or use a free report viewer.
  • Connect Google Postmaster Tools to see Gmail’s view of your domain reputation and spam rate.

Your audience is waiting. Send them something worth opening.

Create a workspace, import your contacts and connect your domain. We take care of delivery from there.

Already a customer? Log in

  • Authenticated sending on your domain
  • Amazon SES sending in the EU and the US
  • Unlimited seats on every plan
  • Every feature on every plan
  • Monthly, cancel any time
  • Your data stays yours
  • Bot-filtered analytics