SPF, DKIM & DMARC: Email Authentication That Lands You in the Inbox

What is email authentication?

Email authentication is a set of DNS records that let inbox providers verify a message genuinely came from the domain it claims. The original email protocol let anyone put any address in the From: field, which is exactly how phishing and spoofing work. SPF, DKIM, and DMARC close that gap: together they prove a message is authorized, unaltered, and aligned with the domain your recipient sees. Without them, even honest mail looks suspicious to Gmail and Yahoo, and in 2026 that means the spam folder or an outright rejection.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a single DNS TXT record that lists every server permitted to send mail for your domain. When a message arrives, the receiving server checks the sending IP against that list. One catch worth knowing: SPF allows at most ten DNS lookups, so chaining too many include: statements, one per tool you send through, can quietly break it. Keep the record short and check it when you add a new sending service.

DKIM: proof the message is genuine

DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key and publishes the matching public key in your DNS. The receiving server uses that public key to confirm two things: the message really came from your domain, and nothing in it was changed in transit. Because the signature travels with the message, DKIM survives forwarding better than SPF does. Most sending platforms generate the key pair and sign for you once you verify your domain.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting & Conformance) is where SPF and DKIM become enforceable. It does two jobs. First, alignment: it requires that the domain passing SPF or DKIM matches the visible From: domain, so a spoofer cannot pass authentication on some unrelated domain and still wear your name. Second, policy: you tell inbox providers what to do with a failing message: nothing (p=none), quarantine (p=quarantine), or reject (p=reject). You also receive daily reports of everyone sending as you.

The right rollout is gradual: start at p=none to watch the reports without affecting delivery, fix any legitimate source that fails alignment, then step up to p=quarantine and eventually p=reject.

SPF vs DKIM vs DMARC at a glance

Three DNS records, three different jobs. You need all three, because they work together rather than replacing one another:

Definitions follow the published standards: SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489), maintained at datatracker.ietf.org and dmarc.org.

Gmail & Yahoo sender requirements (2026)

Both providers published a shared baseline that took effect February 1, 2024, with enforcement tightening from November 2025. The headline rules:

Sources: Google email sender guidelines and Yahoo Sender Hub best practices (accessed 2026).

How to set up SPF, DKIM, and DMARC

1. 01Publish an SPF record: one TXT record listing every service that sends for your domain. Keep it under the ten-lookup limit.
2. 02Turn on DKIM at your sending platform, then add the public key it gives you as a TXT record in your DNS. Most email tools generate this for you.
3. 03Add a DMARC record at _dmarc.your-domain starting with p=none and a reporting address (rua=) so you receive the daily aggregate reports.
4. 04Read the DMARC reports for a few weeks. Confirm every legitimate sender passes SPF or DKIM with From: alignment.
5. 05Tighten the policy to p=quarantine, then p=reject, once the reports are clean. Warm a new sending domain gradually rather than blasting from day one.

How MarketAmp handles authentication

MarketAmp sends every email through Amazon and signs it with DKIM from verified senders, so the DKIM part is handled the moment your domain is verified. For SPF alignment it hands you the exact records to add on a dedicated sending subdomain, and it only suggests a DMARC record when you don’t already have one — so connecting MarketAmp never overwrites the SPF or DMARC that your other mail already depends on. You add the records it shows you once, and from then on every send is signed and aligned. It is the same setup the big senders use, without the manual key work.

Frequently asked questions

01What is the difference between SPF, DKIM, and DMARC?

SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature that proves a message really came from your domain and was not altered. DMARC ties those two checks to the From: address your recipients actually see, and tells inbox providers what to do (nothing, quarantine, or reject) when a message fails. You need all three working together: SPF and DKIM do the proving, DMARC sets the policy and sends you reports.

02Do I need DMARC to send email in 2026?

If you send more than 5,000 messages a day to Gmail or Yahoo, yes. DMARC with at least a p=none policy has been required since February 1, 2024, alongside SPF and DKIM. From November 2025, Gmail began ramping up enforcement, so non-compliant mail now sees temporary and permanent rejections rather than just spam-foldering. Even under 5,000/day, publishing DMARC is strongly recommended because it protects your domain from spoofing.

03What DMARC policy should I start with?

Start at p=none. It changes nothing about delivery but turns on the daily aggregate reports, which show you every source sending as your domain. Read those reports until you are confident every legitimate sender passes SPF or DKIM with alignment, then tighten to p=quarantine, and finally p=reject for full protection. Moving straight to p=reject before you have read the reports risks blocking your own legitimate mail.

04Does my email tool handle authentication for me?

Partly. MarketAmp signs your messages with DKIM once you verify your sending domain, so the DKIM half is handled. For SPF alignment, MarketAmp gives you records to add on a dedicated sending subdomain rather than asking you to change your domain’s existing SPF, and it only suggests a DMARC record when you don’t already have one — so connecting MarketAmp never disturbs the mail you already send from Microsoft 365, Google Workspace, or anywhere else. You add the records it shows you once, and every campaign is signed and aligned from then on.

05Why do my emails go to spam even though SPF and DKIM pass?

Authentication proves who sent a message; it does not make the message wanted. Spam placement after passing SPF and DKIM usually comes down to one of: failed DMARC alignment (the passing domain does not match your From: domain), a poor domain or IP reputation, a spam-complaint rate above 0.3%, stale list hygiene, or spammy content and link patterns. Authentication is the entry ticket, and reputation and list quality decide the seat.

06What is a good spam complaint rate?

Google requires the spam rate reported in Postmaster Tools to stay under 0.3%, and Yahoo holds bulk senders to the same 0.3% complaint threshold. In practice you want to stay well under it, so aim for below 0.1%. The fastest way to spike complaints is mailing people who did not clearly opt in, so permission and easy one-click unsubscribe are your best defense.

Keep exploring