SPF, DKIM and DMARC are three DNS records that let a receiving mail server answer one question: is this email really from the domain it claims to be from? Get them right and you've earned the chance to reach the inbox. Get them wrong and even a perfect email can be rejected before anyone sees it.
The three records at a glance
| Record | What it proves | Example value |
|---|---|---|
| SPF (TXT) | Which servers may send mail for your domain | v=spf1 include:_spf.google.com ~all |
| DKIM (TXT or CNAME) | The message wasn't altered and was signed by your domain | selector._domainkey → public key published by your provider |
| DMARC (TXT at _dmarc) | What to do when SPF/DKIM fail, and where to send reports | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com |
SPF: the list of allowed senders
SPF is a single TXT record on your domain listing every service allowed to send as you: your mailbox provider, your cold email platform, your CRM, your helpdesk. When mail arrives, the receiver checks the sending server against that list.
- Publish exactly one SPF record per domain. Two SPF records is an error, and receivers treat it as a failure.
- SPF allows at most 10 DNS lookups. Every include: counts, and nested includes count too. Too many tools added over the years is the most common reason SPF silently breaks.
- End with ~all (soft fail) while you're testing, and keep the list tidy as you add or remove tools.
DKIM: a signature on every message
DKIM adds a cryptographic signature to each email. Your provider keeps the private key; you publish the matching public key in DNS under a selector name. The receiver uses that public key to confirm the message really came from your domain and wasn't changed in transit.
Each service that sends for you should sign with your domain using its own selector, so they never collide. Platforms that send on your behalf usually give you two or three CNAME records to add; once they resolve, signing is automatic.
DMARC: the policy and the reports
DMARC ties the two together. It tells receivers what to do with mail that fails, and it requires alignment: the domain that passed SPF or DKIM must match the domain in the visible From address. That stops someone from passing SPF on their own domain while pretending to be yours.
- 1p=none
Monitor only. Add rua= and read the aggregate reports for a week or two to find every legitimate sender.
- 2p=quarantine
Failing mail goes to spam. Move here once all your real senders pass and align.
- 3p=reject
Failing mail is refused. The strongest protection against spoofing your domain.
Stynar shows the exact DNS records to add when you connect a custom sending domain, then verifies them for you. It also sends every email with a one-click unsubscribe header and a plain-text part, two other things Gmail and Yahoo look for.
Common mistakes that break authentication
- Two SPF records on the same domain, usually from adding a new tool without merging it into the existing record.
- Going over SPF's 10-lookup limit after years of adding include: entries.
- Leaving DMARC at p=none forever. It reports problems but doesn't protect you.
- Sending cold email from your main company domain. Use a separate, similar domain so one bad campaign can't hurt your everyday email.
- Forgetting subdomains: if you send from mail.yourdomain.com, it needs its own SPF and DKIM.
- Not waiting for DNS. Changes can take up to 48 hours to propagate.
How to check your setup
Send a test email to a Gmail address, open it, and use "Show original". You'll see SPF, DKIM and DMARC each marked PASS or FAIL. Do this for every tool that sends as your domain, and again after any DNS change. Then keep an eye on DMARC reports and Google Postmaster Tools, so a new failure shows up in a report instead of in your reply rate.
Authentication is the foundation, not the whole house. Once it passes, inbox placement is earned by how you send. Our cold email deliverability playbook covers the rest: warmup, bounces, and monitoring.
Frequently asked questions
Do I need SPF, DKIM and DMARC for cold email?
Yes. Gmail and Yahoo require SPF or DKIM for everyone and all three for bulk senders. Without them, cold email is likely to be filtered or rejected.
Can I have more than one SPF record?
No. A domain must have exactly one SPF record. Merge every sender into one record with multiple include: entries, and stay under 10 DNS lookups.
Which DMARC policy should I use?
Start with p=none plus a rua reporting address, then move to p=quarantine once all your legitimate senders pass. p=reject gives the strongest protection.
How long do DNS changes take?
Usually minutes to a few hours, but allow up to 48 hours before assuming a record is wrong.