SPF, DKIM and DMARC: fix your deliverability in 30 minutes
Before any clever email, there are three DNS records that decide whether your mail is trusted, tolerated or silently binned. The good news: checking takes seconds and fixing usually takes minutes — no developer required.
What the three records actually do
- SPF — a list of servers allowed to send mail as your domain. “Only these doors are real.”
- DKIM — a cryptographic signature on each message proving it came from you and was not altered in transit. “This letter carries my seal.”
- DMARC — your public policy for what receivers should do when SPF or DKIM fails, plus a reporting channel. “Here is what to do with impostors.”
Gmail and Microsoft increasingly require all three to accept bulk mail. Missing or broken records do not fail loudly — your mail just quietly performs worse.
Fixing SPF (2 minutes)
- One SPF record only. Two SPF records on a domain is a guaranteed fail — merge them.
- Include your real senders: Google Workspace uses include:_spf.google.com.
- End with ~all (soft fail) while you are testing, -all (hard fail) once everything you send is covered.
- Stay under 10 DNS lookups — bloated SPF records fail silently past the limit.
Setting up DKIM (5 minutes)
- In Google Workspace: Apps → Gmail → Authenticate email → generate a 2048-bit key.
- Publish the TXT record at google._domainkey.yourdomain.com exactly as shown.
- Click “Start authentication” in the admin panel. If your normal email is already landing, DKIM is usually done — the checker will confirm.
The DMARC ramp that never breaks your inbox
DMARC starts permissive and tightens: publish p=none with a reporting address for two weeks and read the reports — if your legitimate senders pass SPF or DKIM, move to p=quarantine, then p=reject. Skipping straight to reject is how people kill their own password-reset emails.
The usual mistakes
- A second SPF record “just in case” — that alone fails the check.
- DKIM selector published at the wrong hostname — the signature never validates.
- “p=reject” on day one on a domain with forgotten senders — invoices and resets start bouncing.
- Setting records and never re-checking — a hosting migration can wipe DNS silently.
Questions we get asked about this
Do I need all three records?
For cold outreach from your own domain: yes. SPF alone does not survive forwards, DKIM alone does not stop spoofing, and receivers increasingly expect DMARC alignment between the two.
How long do DNS changes take?
Usually minutes, occasionally a few hours depending on TTLs. Re-run the checker after 15 minutes; if it still fails, verify you edited the right record set.
Does ProspectBeam check this for me?
Yes — the same deliverability engine is built into the product, so mailbox setup includes an SPF/DKIM/DMARC check before a mailbox can verify and send.
Keep reading