holymailer
Back

SPF, DKIM, and DMARC

June 13, 2026

SPF, DKIM, and DMARC

SPF, DKIM, and DMARC are three DNS records that verify the authenticity of an email sender and protect a domain from spoofing. Without them, emails end up in spam or get rejected by the recipient's server.

SPF, DKIM, and DMARC are three DNS records that verify the authenticity of an email sender and protect a domain from spoofing. Without them, emails end up in spam or get rejected by the recipient's server.

What is SPF

SPF (Sender Policy Framework) is a DNS record that lists the servers authorized to send email on behalf of a domain.

When a mail server receives a message from @yourdomain.com, it checks the domain's SPF record to see whether the sender's IP address is on the allowed list. If not, the email is flagged as suspicious.

Example SPF record:

v=spf1 include:_spf.google.com ~all
  • v=spf1 — protocol version
  • include: — authorized sending services
  • ~all — mark all other servers as suspicious (-all rejects them entirely)

Key facts:

  • SPF only checks the technical sender address (envelope-from), not the one visible to the user
  • A maximum of 10 DNS lookups are allowed in an SPF record — exceeding this makes the record invalid
  • SPF protects against direct domain spoofing, but not against display name impersonation

What is DKIM

DKIM (DomainKeys Identified Mail) is a digital signature added to an email that allows the recipient to verify the message hasn't been altered in transit.

How it works:

  1. The sender's server signs the email with a private key
  2. The public key is published in the domain's DNS
  3. The recipient's server verifies the signature against the public key

Example DKIM DNS record:

selector._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

Why DKIM matters:

  • Confirms that the email content hasn't been modified since sending
  • Contributes to domain reputation (Gmail and Outlook factor DKIM into their scoring)
  • According to Google, domains with a valid DKIM record receive 15–20% fewer spam flags

What is DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy that tells receiving servers what to do with emails that fail SPF or DKIM checks.

DMARC ties SPF and DKIM together and adds an instruction for mail servers.

Three DMARC policies:

PolicyActionWhen to use
p=noneDo nothing, collect reports onlyDuring initial setup
p=quarantineSend to spam folderAfter reviewing reports
p=rejectReject the message entirelyWhen confident in your setup

Example DMARC record:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"
  • rua= — address for receiving aggregate reports
  • Reports show who is sending email from your domain and from which servers

How SPF, DKIM, and DMARC work together

Sender → [email with DKIM signature]
      ↓
Recipient's server:
 1. Checks SPF: is this IP authorized?
 2. Checks DKIM: is the signature valid?
 3. Checks DMARC: what to do if checks fail?
      ↓
Result: deliver / spam / reject

According to Valimail (2024), domains with SPF + DKIM + DMARC configured see 40% more emails land in the inbox compared to domains without these records.

Why cold outreach needs separate domains

The main risk of cold outreach is damage to your primary domain's reputation. If campaigns sent from yourbrand.com generate spam complaints, it affects all company emails — including transactional messages and client communications.

The standard practice is to use alias domains (yourbrand-mail.com, yourbrand-outreach.com) and configure SPF/DKIM/DMARC separately for each one.

HolyMailer automatically configures SPF, DKIM, DMARC, and MX records for every new domain within 10 minutes — no manual DNS work required.

FAQ

Do I need to set up all three records?
For cold outreach — yes. Since February 2024, Google and Yahoo require SPF, DKIM, and DMARC for bulk senders (more than 5,000 emails per day). Without them, emails are rejected.

What should I check first?
Start with DKIM — its absence has the greatest impact on deliverability. Then SPF, then DMARC with p=none.

How do I verify my records are set up correctly?
Use free tools: MXToolbox, Mail-tester.com, or Google Postmaster Tools.

How long does manual SPF/DKIM/DMARC setup take?
According to HolyMailer, manual setup for a single domain takes an average of 32 hours, including record verification, troubleshooting, and testing.

Do I need DMARC if I already have SPF and DKIM?
Yes. SPF and DKIM verify authenticity, but without DMARC the recipient's server has no instruction on what to do with emails that fail those checks. DMARC closes the loop on your protection chain.