ON THIS PAGE
Email authentication sounds like plumbing until Gmail starts rejecting your mail. If you send cold email and your domain is not authenticated with SPF, DKIM and DMARC, your campaigns are rejected or spam-foldered before a human ever sees them. Here is what each record actually does, in plain English, with the exact steps to set them up.
Why authentication stopped being optional
Since February 2024, Google and Yahoo require SPF, DKIM and DMARC from anyone sending volume. Miss one and your mail is rejected or spam-foldered on arrival, no matter how good the copy is. This is the single most common reason a cold email domain suddenly stops landing in the inbox.
SPF: the guest list
SPF (Sender Policy Framework) is a DNS TXT record listing which mail servers are allowed to send email for your domain. When mail arrives claiming to be from you, the receiver checks the sending server against your list. Not on it? Suspicious.
It looks like v=spf1 include:_spf.google.com ~all. Two rules matter: you may have only one SPF record (two is an automatic fail), and you must stay under 10 DNS lookups. Generate a valid one with the free SPF record generator.
DKIM: the wax seal
DKIM (DomainKeys Identified Mail) cryptographically signs every message you send. The public key lives in your DNS under a selector (like google._domainkey); receivers use it to confirm the message was not altered and genuinely came from your domain. Your email provider (Google Workspace, AWS SES, Resend) generates the key and gives you the record to publish.
DMARC: the policy
DMARC ties SPF and DKIM together and answers one question: what should receivers do when a message fails? Three options:
p=none: do nothing, just send reports (start here).p=quarantine: send failing mail to spam.p=reject: refuse failing mail outright (full protection).
It is published at _dmarc.yourdomain.com. Build a valid record with the free DMARC record generator.
Most companies never get past the first step: only 15.6% of the 458,977 B2B domains in our State of B2B email infrastructure study enforce p=reject.
The rollout order that does not break delivery
p=none for 2 to 4 weeks while you read the aggregate reports and fix any sender that fails. Then move to p=quarantine, then p=reject. Jumping straight to reject with a misconfigured sender silently kills your own legitimate mail.Check your setup in 10 seconds
Run your domain through the free deliverability test: it checks all three records plus MX and scores the result. Then keep the authenticated domain healthy with warm-up and verified lists via the email verifier. The full deliverability playbook is in our deliverability guide.
FAQ: SPF, DKIM and DMARC
Do I really need all three?
Yes. Since 2024 Gmail and Yahoo require SPF, DKIM and DMARC from volume senders. Missing one means rejection or spam.
Which DMARC policy should I start with?
Start with p=none to collect reports without affecting delivery, then tighten to quarantine and reject over 2 to 4 weeks.
Can I have two SPF records?
No. Multiple SPF records are invalid and fail authentication. Merge all senders into one record with the SPF generator.
How do I check if my records are correct?
Use the free deliverability test, which validates SPF, DKIM, DMARC and MX and scores your domain.