SPF: who may send for your domain

SPF is a TXT record on your domain listing the servers allowed to send its mail. A typical record for a domain using Google Workspace and a newsletter service looks like:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
  • Have exactly one SPF record. Two records make SPF fail entirely.
  • Every include counts towards a limit of 10 DNS lookups. Go over it and SPF fails. Remove services you no longer use.
  • End with ~all (soft fail) while setting up, or -all when you're sure the list is complete.

DKIM: a signature on every message

DKIM adds a cryptographic signature to each email. Your email provider generates the key and gives you a TXT record to publish at a name like google._domainkey.yourdomain.com. The part before ._domainkey is the selector.

  • Turn DKIM on separately for every service that sends as your domain: your mailbox provider, your newsletter tool, your helpdesk.
  • Use 2048-bit keys where the provider offers them; 1024-bit keys are considered weak.

Our DKIM checker finds the keys published for your domain and tells you if any are too short, cut off or revoked.

DMARC: what to do when checks fail

DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports. Publish it as a TXT record at _dmarc.yourdomain.com. Start with monitoring only:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Read the reports for a few weeks to find every service sending as your domain. Once they all pass, tighten the policy to p=quarantine (spam folder) and finally p=reject.

DMARC also needs alignment: the domain in the visible From address must match the domain that passed SPF or DKIM. A newsletter tool sending with its own domain passes SPF for itself, not for you, which is why DKIM for each tool matters.

What Gmail and Yahoo require

  • Everyone: SPF or DKIM, valid reverse DNS on the sending IP, TLS, and a spam complaint rate below 0.3%.
  • Senders of more than 5,000 messages a day to Gmail: SPF and DKIM, a DMARC record (at least p=none), alignment, and one-click unsubscribe in marketing mail.

Check your setup

DNS changes can take a few minutes to an hour to appear. Then run your domain through the SPF & DMARC check and the DKIM checker. If mail still lands in spam with everything passing, check the blocklists and your sending volume.