You cannot negotiate with a mail filter that cannot identify you. The Postmaster doesn't evaluate your subject line, your send time, or your creative — if your domain arrives without
SPF,
DKIM, and
DMARC, you are a ghost, and the door stays closed. Authentication is not a deliverability tactic; it is the floor every other tactic stands on.
Set Up SPF: Declare Your Authorized Senders
SPF (Sender Policy Framework) is a DNS TXT record that tells receiving servers which IP addresses are allowed to send mail on behalf of your domain. Without it, your messages carry no verified origin.
- Publish one SPF record per sending domain:
v=spf1 include:[your-esp.com] ~all. Multiple SPF TXT records on the same domain cause a PermError and fail authentication.
- Respect the 10-lookup limit. SPF resolves DNS lookups for
include:, a:, and mx: mechanisms. Exceeding 10 lookups causes a permanent SPF failure. Audit your record with MXToolbox's SPF checker before deploying.
- Use softfail (
~all) initially to observe failures without blocking legitimate mail. Escalate to hardfail (-all) once you've confirmed all legitimate sending sources are covered.
- Cover every source: transactional mail, marketing mail, automated notifications, and any third-party sender acting on your behalf all need to be included.
Configure DKIM: Sign Every Message
DKIM signs outgoing messages with a private cryptographic key. The receiving server retrieves the matching public key from your DNS and verifies the signature — confirming the message came from your domain and arrived unaltered.
- Generate a 2048-bit RSA key pair. Most ESPs handle key generation automatically. For self-managed MTAs, use
openssl genrsa 2048 and publish the public key as a DNS TXT record on a named selector.
- Sign all outgoing streams — not just marketing campaigns. Transactional, triggered, and notification mail all require valid DKIM signatures to pass DMARC alignment.
- Rotate selectors every 6–12 months by generating a new key pair and migrating signing to the new selector. Rotation limits exposure if a private key is compromised.
- Verify DMARC alignment: the DKIM
d= tag domain must match the visible From: header domain, or DMARC alignment will fail even if the DKIM signature itself is valid.
Enforce DMARC: Close the Loop and Protect Your Domain
DMARC defines what receiving servers do when SPF or DKIM fails, and delivers aggregate reports on every mail stream that claims to be from your domain — including ones you didn't authorize.
- Start at
p=none with rua= pointing to a reporting address. Do not skip this phase — DMARC reports reveal sending sources you didn't know existed.
- Escalate to
p=quarantine once you've confirmed SPF and DKIM pass for all legitimate sending streams. Failing mail goes to spam instead of the inbox.
- Move to
p=reject for full enforcement. This blocks all unauthenticated mail claiming your domain — including phishing — at the receiving server.
- Use a DMARC analytics service (Dmarcian, Valimail, EasyDMARC, or Postmark's DMARC Digests) to parse aggregate reports into readable summaries. Raw XML reports from mailbox providers are not designed for human review.
Unlock BIMI: The Visible Reward for Full Compliance
Once DMARC is enforced at p=quarantine or p=reject and SPF and DKIM are consistently passing, you're eligible for BIMI (Brand Indicators for Message Identification) — a standard that displays your verified brand logo next to messages in Gmail, Yahoo, and Apple Mail.
- Obtain a Verified Mark Certificate (VMC) from DigiCert or Entrust. This requires a registered, trademarked version of your logo in SVG format.
- Publish a
default._bimi DNS TXT record pointing to your SVG logo URL and your VMC.
- BIMI is a trust signal, not a ranking factor — but verified logo display in the inbox is a consistent open rate lift, particularly for brand-recognition-sensitive senders.
Conclusion
SPF, DKIM, and DMARC are not optional deliverability tactics — they are the baseline identity layer that receiving infrastructure requires to treat your mail as legitimate. Getting all three configured correctly, escalating DMARC to enforcement, and completing the BIMI extension makes your domain provably yours in every inbox on the internet.
Your Authentication Checklist:
- SPF record published, all sending IPs and ESPs included, under the 10-lookup limit.
- DKIM 2048-bit key generated, public key in DNS on a named selector, all streams signed.
- DMARC at
p=none with rua= reporting address — review reports and escalate to p=reject.
- DMARC identifier alignment verified: From: header domain matches SPF/DKIM
d= domain.
- BIMI record and VMC in place once DMARC enforcement is stable.
Educational content. Email deliverability evolves rapidly. Platform rules (Gmail, Yahoo, etc.), engagement signals, and ESP behaviours change frequently, and real-world issues often involve conflicting signals, data quality problems, and failure modes that general best practices can’t anticipate. Content on this site is provided for informational purposes only and does not replace a thorough analysis by a qualified deliverability professional.
Terms of Use