Why this matters
SPF, DKIM, and DMARC are the three standards that prove your emails are really from you. Inbox providers use them to decide whether to deliver your message, send it to spam, or reject it. You don't need to be an expert, but a basic understanding helps you set things up correctly and troubleshoot when something goes wrong.
This page explains the concepts. For the actual setup steps, see Authenticating your domain.
SPF (Sender Policy Framework)
SPF lists which mail servers are allowed to send email for your domain. When a provider receives your message, it checks that it came from an approved server.
When you send through our platform, SPF is handled for you by our sending infrastructure, so there is no SPF record for you to add. (Aligning your bounce domain, described in Tracking and bounce domains, is what ties this to your own domain.)
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to every email you send. The receiving provider uses it to confirm two things: that the message really came from your domain, and that it wasn't changed in transit.
This is the record you add to your DNS when you authenticate your domain. We generate it for you as a TXT record.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties SPF and DKIM together and lets you, the domain owner, decide what a provider should do with email that fails authentication. It also lets you receive reports about who is sending email using your domain.
A DMARC record is published as a TXT record named _dmarc.yourdomain.com. If you don't have one yet, start with this value:
Code
DMARC policy levels
The p= part is your policy. You can tighten it over time as you gain confidence:
p=none- monitor only; nothing is blocked. Start here.p=quarantine- failing email is sent to spam.p=reject- failing email is rejected outright.
Begin with p=none, review your reports, and move to stricter policies once you're sure all your legitimate email passes.
How this works on our platform
- You add the DKIM record we generate.
- We verify your DKIM and DMARC records during authentication.
- SPF is handled for you by our sending infrastructure.
Related articles
- Authenticating your domain - Set up DKIM and DMARC
- Tracking and bounce domains - Align your domain
- Meeting Gmail and Yahoo sender requirements - Why this is required
- Adding DNS records at your hosting provider - Where to add records