SPF, DKIM and DMARC: how to keep your e-mails out of spam

SPF, DKIM and DMARC are three DNS records that prove to receiving mail servers that messages sent in your domain's name are legitimate. Without them, your e-mail is far more likely to land in spam or be rejected. Here's what each one does, with example records, a safe way to roll out DMARC, and what Gmail, Yahoo and Microsoft require today.

Why e-mail ends up in spam

Anyone can write an e-mail that claims to come from [email protected]. The receiving server can only tell whether it's genuine by checking what you have published in DNS. If it finds nothing, it treats the message with suspicion. The three mechanisms each answer a different question:

SPF: the list of authorised servers

SPF (Sender Policy Framework) lists the servers allowed to send e-mail for your domain. A typical record for a domain that sends from its hosting server and through a newsletter service:

v=spf1 a mx include:_spf.newsletter-service.example ~all

• a and mx: the servers in the domain's A and MX records may send.
• include:: adds another provider's servers. The exact value is in that provider's documentation.
• ~all: everyone else is suspicious (softfail). -all means a hard fail.

Key rules: a domain gets one SPF record. Two records make both invalid, so merge them. The standard (RFC 7208) caps an SPF check at 10 DNS lookups, so don't stack dozens of includes. For a domain that never sends mail, publish v=spf1 -all.

DKIM: the message's digital signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The private key stays on the sending server, and you publish the public key in DNS under a "selector":

default._domainkey.yourcompany.ro TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

The receiving server fetches the public key and checks the signature. That tells it whether the message really came from your domain and whether it was changed along the way. You don't need to generate keys yourself. Your hosting control panel usually creates them (in cPanel, for example: Email → Email Deliverability). External services such as newsletter tools, CRMs or online shops give you their own DKIM records to add separately. Google recommends keys of at least 2048 bits where your provider supports them. The minimum it accepts is 1024.

DMARC: the policy and the reports

DMARC ties everything together. It requires the message to pass SPF or DKIM with a domain that aligns with the "From" address the reader sees. It also tells the receiving server what to do when that check fails:

• p=none: take no action, just report (monitoring mode).
• p=quarantine: deliver to spam.
• p=reject: refuse the message.

A starting record:

_dmarc.yourcompany.ro TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

The rua tag is the address where the big providers send you daily reports (XML files) showing who sends mail in your domain's name. Use a separate mailbox or a service that turns the reports into charts.

Moving from p=none to quarantine, step by step

1. Inventory: list everything that sends mail for the domain: the hosting server, the website (forms, shop), newsletters, invoicing software, the CRM.
2. SPF and DKIM for each: set them up for every source on that list.
3. Publish p=none with rua and read the reports for 2–4 weeks. Fix any legitimate source that still fails.
4. Switch to p=quarantine. You can phase it in with pct=25, then 50, then 100.
5. Once everything is clean, move to p=reject. That gives you the best protection against impersonation.

What Gmail, Yahoo and Microsoft require (at the time of writing)

• Gmail (sender guidelines): since 1 February 2024, all senders to personal Gmail accounts need SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate below 0.3%. Anyone sending more than 5,000 messages a day also needs SPF, DKIM and DMARC (at least p=none), alignment with the "From" domain, and one-click unsubscribe for marketing mail. Google announced that from November 2025 it is enforcing these rules more strictly, so non-compliant mail may be delayed or rejected.
• Yahoo (sender best practices): similar rules. All senders need SPF or DKIM. Bulk senders need SPF and DKIM, DMARC of at least p=none, one-click unsubscribe, unsubscribe requests honoured within 2 days, and a spam rate below 0.3%.
• Microsoft (Outlook.com, Hotmail, Live): since 5 May 2025, domains sending more than 5,000 messages a day must have SPF, DKIM and DMARC (at least p=none). Non-compliant mail goes to Junk, and Microsoft has said it will start rejecting it later.

Even if you send only a little mail, set up all three. The bulk-sender rules are gradually becoming everyone's baseline.

How to test

• Gmail → "Show original": send yourself a message and check the SPF, DKIM and DMARC results (PASS/FAIL).
• Google Admin Toolbox – Check MX: checks your domain's DNS records.
• MXToolbox: separate lookups for SPF, DKIM, DMARC and blacklists.
• mail-tester.com: send an e-mail to the generated address and get a score.
• Google Postmaster Tools: spam rate and domain reputation, if you send larger volumes to Gmail.

DNS changes can take anywhere from minutes to a few hours to propagate, so test again a little later. You add the records in your domain's DNS zone: in the hosting panel if you use our nameservers, or with whoever manages your DNS.

Checklist

• One SPF record, listing every legitimate source and staying under 10 DNS lookups.
• DKIM enabled on the hosting server and on every external service that sends mail.
• DMARC published, starting with p=none and rua, then quarantine, then reject.
• Tested with Gmail's "Show original" and mail-tester.com.
• For newsletters: one-click unsubscribe and clean lists.

Is your e-mail on our hosting and you're not sure what values to use? Write to [email protected] with your domain name and we'll help you check your records.