DeliverSight Run a free test
· 7 min read

Fix SPF, DKIM, and DMARC — in the right order

A practical, no-fluff guide to setting up email authentication correctly: what each record does, the order to configure them, and how to verify alignment.

SPFDKIMDMARCauthentication

Email authentication is the single biggest lever on whether your mail reaches the inbox. Get it wrong and even perfectly legitimate campaigns get filtered. The good news: there are only three records to set up, and they have a natural order.

1. SPF — say who is allowed to send

SPF (Sender Policy Framework) is a TXT record listing the servers permitted to send mail for your domain. Receivers check the envelope sender against it.

v=spf1 include:_spf.google.com include:sendgrid.net -all

Two rules that trip people up:

  • Stay under 10 DNS lookups. Every include: counts. Flatten or consolidate if you hit the limit, or SPF returns permerror.
  • End with -all (hard fail), not ~all, once you are confident the list is complete.

2. DKIM — sign every message

DKIM adds a cryptographic signature in the headers so receivers can confirm the message was not altered and really came from you. Your ESP gives you a public key to publish:

selector._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0G..."

Use a 2048-bit key where your provider supports it. Rotate keys periodically and keep the selector names predictable (e.g. s1, s2).

3. DMARC — tell receivers what to do

DMARC ties SPF and DKIM together with alignment (the authenticated domain must match the visible From: domain) and tells receivers how to treat failures.

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=s; aspf=s"

Start at p=none to collect reports without affecting delivery, then move to quarantine and finally reject once your aggregate reports are clean.

Order matters: SPF and DKIM must pass and align before a strict DMARC policy is safe. Jumping straight to p=reject is the most common way teams blackhole their own mail.

Verify before you trust

Publishing a record is not the same as it working. Send a real message through DeliverSight and confirm:

  • SPF result is pass and aligned
  • DKIM signature verifies against the published key
  • DMARC shows aligned with your intended policy

Once all three are green, you have removed the biggest reason inbox providers distrust your mail — and you have the reports to keep it that way.