Email deliverability is your ability to reach a recipient’s inbox, not simply send a message. SPF, DKIM and DMARC help receiving servers check whether mail using your domain is authorised. They reduce impersonation risk, but they cannot guarantee inbox placement.
In plain English: SPF identifies authorised sending systems, DKIM adds a verifiable digital signature, and DMARC checks whether authentication matches the domain readers see. Set them up together, test every sending platform, then tighten your protection gradually.
1. Understand what each standard actually checks
SPF: is this server authorised?
Sender Policy Framework, or SPF, is a DNS record listing the systems permitted to send mail for a domain. Receiving servers check the sending IP address against this policy. Crucially, SPF normally checks the envelope sender domain, often shown as the Return-Path, rather than the visible From address.
A business in Islamabad might send through Microsoft 365, a newsletter platform and an invoicing tool. Each needs an appropriate authentication setup, although some platforms use their own envelope sender domain unless you configure a custom one.
DKIM: does the signature verify?
DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to outgoing messages. The receiving server retrieves a public key from DNS and checks it. A valid signature demonstrates that the signed content has not changed and that the signing system holds the corresponding private key.
DKIM is not encryption: recipients and mail providers can still read the message. Its job is to authenticate signed content and associate it with a signing domain.
DMARC: does authentication match your identity?
Domain-based Message Authentication, Reporting and Conformance, or DMARC, connects authentication to the visible From domain. It passes when at least one of these conditions is met:
- SPF passes and its checked domain aligns with the visible From domain.
- DKIM passes and its signing domain aligns with the visible From domain.
Under relaxed alignment, domains can share the same organisational domain. Strict alignment requires an exact match. DMARC also publishes your preferred handling policy for failures and can request aggregate reports.
2. List your senders before changing DNS
The most common implementation mistake is protecting the main mailbox while overlooking automated messages. Before making changes, build a sender inventory with your marketing team, IT administrator and website developer.
- List human mailboxes: include sales, support, accounts and individual staff accounts.
- List automated systems: include newsletters, CRM sequences, invoices, password resets, booking confirmations and website forms.
- Record each identity: note the visible From domain, envelope sender domain and DKIM signing domain where available.
- Confirm ownership: identify who can access authoritative DNS and each platform’s authentication settings.
- Save existing records: keep a dated copy before editing anything.
For example, a Lahore retailer might use one provider for staff email and another for order confirmations. Authenticating only staff mail could leave purchase receipts failing DMARC when enforcement starts.
For website forms, use an address on your authenticated domain as the From address. Put the visitor’s email in Reply-To instead. Pretending to send directly from a visitor’s Gmail or business address can trigger authentication failures.
3. Configure SPF and DKIM, then verify real messages
Make changes in the service hosting your authoritative DNS, which may differ from your registrar or website host. Follow each email provider’s exact instructions rather than copying another company’s records.
SPF setup checklist
- Publish one SPF record per domain: multiple TXT records starting with v=spf1 at the same hostname cause an SPF error. Merge authorised sources where necessary.
- Check the lookup limit: SPF permits up to 10 DNS-querying mechanisms and modifiers during evaluation. Nested includes count too.
- Remove obsolete senders: an abandoned platform should not retain authorisation indefinitely.
- Review the ending: ~all expresses a soft failure; -all expresses a failure. Neither replaces DMARC alignment.
DKIM setup checklist
- Generate keys within the sending platform: providers typically supply TXT or CNAME records containing selector information.
- Use 2048-bit keys where supported: check provider and DNS limitations before publishing.
- Enable signing: adding DNS records alone may not activate DKIM in the platform.
- Test every sender: send actual newsletters, receipts and staff messages, not just one mailbox test.
Open the received message’s original headers and inspect the receiving provider’s Authentication-Results. Look for SPF, DKIM and DMARC results, then check the associated domains. An SPF pass for an unrelated provider domain does not, by itself, establish DMARC alignment.
Allow for DNS caching according to the record’s time to live. Repeatedly changing records before earlier edits become visible makes troubleshooting harder.
4. Introduce DMARC without blocking legitimate mail
A sensible email deliverability plan starts DMARC in monitoring mode. For a domain you control, an illustrative TXT record at _dmarc.example.com is:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
Replace the example domain and reporting address with your own. Create the reporting mailbox first, or use a report-processing service. External reporting destinations may require additional DNS authorisation.
- Monitor: p=none requests no enforcement based on DMARC failure. Collect reports across a representative sending cycle.
- Investigate: identify legitimate platforms with failed alignment and distinguish them from unauthorised traffic.
- Quarantine: once legitimate streams pass, p=quarantine asks receivers to treat failures as suspicious, commonly by placing them in spam.
- Reject: p=reject asks receivers to refuse failing messages. Apply it only after validating active senders and subdomains.
A straightforward setup typically needs two to four weeks of monitoring, but monthly invoices or seasonal campaigns may require longer. Calendar time alone is not evidence that enforcement is safe. Receiving providers also retain discretion over final handling.
Forwarding can break SPF because the forwarding server’s IP is not authorised. DKIM can survive forwarding if signed content remains unchanged, which makes aligned DKIM especially valuable.
5. Fix the factors authentication cannot solve
Strong authentication supports email deliverability, but inbox providers also consider reputation, complaints, recipient behaviour and sending patterns. A properly signed message can still be unwanted spam.
- Use permission-based lists: avoid purchased contacts and keep records of consent.
- Suppress hard bounces: stop repeatedly sending to invalid addresses.
- Make unsubscribing straightforward: support one-click unsubscribe where required by receiving providers.
- Increase volume gradually: avoid sudden campaign spikes from new domains.
- Separate message types: consider distinct marketing and transactional subdomains, while recognising that reputation is not completely isolated.
Track authentication failures, bounce reasons, complaints, unsubscribes and conversions by platform. Treat open rates cautiously because privacy features and automated activity can distort them. Check current Gmail and Yahoo sender requirements before launching bulk campaigns.
SEOISB, part of HA Technologies and based in Blue Area, Islamabad, can help connect campaign planning with technical checks. Explore the email marketing service at /services-email-marketing; for complementary organic acquisition support, review /seo-packages.
Frequently asked questions
Do SPF, DKIM and DMARC guarantee inbox placement?
No. They establish authentication and domain alignment. Email deliverability also depends on reputation, consent, content, complaints and receiver-specific filtering.
Can I use DMARC without SPF passing?
Yes. DMARC can pass through valid, aligned DKIM alone. Configure both SPF and DKIM where possible so legitimate messages have more than one authentication route.
Will DMARC reject every spoofed email?
No. Enforcement helps protect your exact domain against unauthenticated impersonation. It does not stop lookalike domains, misleading display names or abuse of compromised legitimate accounts.
Want a clearer view of your digital marketing priorities? Request a free SEO analysis from SEOISB at /request-a-free-seo-analysis.