SPF, DKIM and DMARC are DNS records that let receiving mail servers check that an email really comes from the domain it claims. SPF lists which servers may send for your domain, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when a message fails and where to send reports. Since major mailbox providers now expect them from senders, marketers who send campaigns from their own domain should treat them as basic hygiene.
The three records in plain terms
SPF (Sender Policy Framework) is a published list of the services allowed to send email for your domain: your email platform, your website forms, your invoicing tool. Google’s guidance asks you to publish an SPF record that includes all of your domain’s email senders (Google).
DKIM (DomainKeys Identified Mail) attaches a signature to each message, which receivers verify against a public key in your DNS. Google states that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommends 2048 bits if your provider supports it.
DMARC builds on both. The specification describes it as a mechanism that lets a domain owner say how receivers should handle messages claiming to come from the domain, and request reports about that mail. It checks whether the domain in the visible From address aligns with a domain that passed SPF or DKIM, and a message passes if at least one of those methods both passes and aligns (RFC 7489). The policy is published as a DNS TXT record and can be set to none (monitor only), quarantine or reject. Note that the RFC has since been superseded by newer documents, but the core concepts above are what most providers still describe.
| Record | Answers the question | Where it lives |
|---|---|---|
| SPF | Is this server allowed to send for the domain? | DNS TXT on your domain |
| DKIM | Was this message signed and unaltered? | DNS key, plus signing by your sender |
| DMARC | Does the From domain align, and what should happen if not? | DNS TXT at _dmarc |
What Gmail requires
Google’s published sender guidelines say all senders should set up SPF or DKIM. Bulk senders, defined as those sending more than 5,000 messages a day to Gmail accounts, must set up SPF, DKIM and DMARC, and the DMARC policy may be set to none. Marketing and subscribed messages from bulk senders must support one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Post headers, plus a visible unsubscribe link. Google also asks senders to keep the spam rate in Postmaster Tools below 0.10% and to avoid ever reaching 0.30%.
You may send far fewer messages than that. Requirements and thresholds can change, so check the current page, but authenticating anyway helps protect your domain from being spoofed.
A safe rollout
- Inventory your senders. List every tool that sends as your domain, including ones nobody remembers setting up.
- Publish SPF including each legitimate sender. Keep one SPF record per domain, not several.
- Turn on DKIM in each sending platform and publish the keys it gives you.
- Publish DMARC at policy none with a reporting address. This changes nothing about delivery, but starts collecting aggregate reports.
- Read the reports for a few weeks and fix legitimate senders that fail alignment.
- Tighten gradually to quarantine and then reject, using the percentage setting the specification provides for gradual rollout, once reports are clean.
What authentication does not do
The RFC is clear that DMARC authenticates domains, not message content, and does not address display-name spoofing or lookalike domains. It also does not grant better delivery treatment: receivers apply it as they see fit. Passing authentication gets you into consideration, but content, list quality and complaints still decide inbox placement. Sending to people who did not ask, or ignoring unsubscribes, will hurt you regardless, which is why list practices matter as much as DNS. The rules on promotional messages are summarised in advertising law basics in Australia.
Common mistakes
- Two SPF records on one domain, which breaks SPF.
- Moving to reject before reviewing reports, and blocking your own invoices or booking confirmations.
- Forgetting a subdomain used by a website form or CRM.
- Treating the setup as one-off. Adding a new tool means updating records.
DNS access is often held by a web host or developer, so confirm who controls it early. It belongs on any website launch checklist, and measurement questions that follow campaigns are discussed in marketing attribution basics.
Where Radiance Impact fits
Radiance Impact’s Technology division handles websites and workflow automation, including the forms and notifications that send email from your domain, and the Growth division covers campaigns. For help planning a clean sending setup, see /technology and get in touch through /contact.
