SPF, DKIM, and DMARC Explained for Non-Technical Creators
Some of your emails vanish into spam not because of your subject line, but because inbox providers cannot prove the mail is really from you. Here is the fix.
If you send newsletters, course announcements, or launch emails and some of them quietly vanish into spam, the problem usually is not your subject line. It is that the inbox provider — Gmail, Outlook, Yahoo — cannot confirm the mail actually came from you. Email was designed in an era of trust, which means anyone can stamp your name and address on a message the same way anyone can scribble a fake return address on an envelope. SPF, DKIM, and DMARC are the three records that prove you are who you say you are.
You do not need to be technical to set them up. This guide explains what each one does in plain English, why they matter more than ever, and the exact order to switch them on.
Why this suddenly matters
In February 2024, Gmail and Yahoo began requiring bulk senders — roughly anyone sending 5,000 or more messages a day to their users — to authenticate mail with SPF and DKIM and to publish a DMARC record. Miss the mark and your mail gets throttled or refused outright.
Here is the part most creators overlook: even if you never come close to 5,000 messages a day, mailbox providers use these same signals to decide where all your mail lands. Authenticated mail from a consistent domain builds a sender reputation over time. Unauthenticated mail starts every send from a position of suspicion. So this is not just a compliance checkbox for big companies — it is the foundation of whether your audience ever sees what you write.
The three records, in plain English
Picture every email you send as a physical letter arriving at a sorting office. The three records answer three different questions the sorting office asks before it decides whether to deliver.
SPF — the guest list
SPF (Sender Policy Framework) is a list of the servers allowed to send email on behalf of your domain. When your platform sends a campaign, the receiving server checks: is this sending server on the domain owner's approved list? If yes, the letter passes. If a spammer sends from some random server pretending to be you, they are not on the list, and it fails.
An SPF record is a single line of text you add to your domain. It looks like this:
v=spf1 include:_spf.yourprovider.com ~all
The include part is your email provider vouching that its servers are authorized. You never write this from scratch — your provider hands you the exact value to paste.
DKIM — the tamper-proof seal
DKIM (DomainKeys Identified Mail) adds an invisible cryptographic signature to every message, like a wax seal pressed into a letter. The receiving server uses a public key published on your domain to confirm two things: the mail genuinely came from your domain, and nobody altered it in transit. SPF proves the sender is allowed; DKIM proves the message itself is authentic and untouched.
Your email provider generates the key pair and gives you a record to publish — usually a CNAME or TXT entry with a "selector" name. Again, you copy and paste. You never touch the cryptography yourself.
DMARC — the instructions and the report
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the first two together and answers the final question: if a message fails these checks, what should I do with it, and who do I tell? It also emails you reports showing everyone who is sending mail under your domain — including impersonators you would otherwise never see.
A starter DMARC record looks like this:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com
The p (policy) value is the dial that matters, and you move it through three settings in order:
- p=none — monitor only. Nothing is blocked; you simply collect reports. Always start here.
- p=quarantine — mail that fails is sent to the spam folder. Move here once you have confirmed your real mail passes.
- p=reject — mail that fails is refused entirely. This is the end goal and your full protection against impersonation.
How the three fit together
| Record | The question it answers | Analogy |
|---|---|---|
| SPF | Is this server allowed to send for the domain? | The guest list |
| DKIM | Is the message genuine and unaltered? | The tamper-proof seal |
| DMARC | What happens if the checks fail — and who is told? | The instructions and audit log |
How to switch them on, in order
- Find where your domain's DNS lives. This is wherever you bought your domain or where your site is hosted — the settings page labelled "DNS" or "DNS records." That is where every record below gets added.
- Get your records from your email platform. Every reputable sending tool has a "domain authentication" or "verify your domain" screen that generates your exact SPF and DKIM records. Open it and copy them.
- Add them as DNS records. Paste each value in as a new record of the type your provider specifies (TXT or CNAME), then save.
- Publish a DMARC record at p=none. Add the starter record above so you begin collecting reports without putting any real mail at risk.
- Wait, then verify. DNS changes can take a few hours to spread. Send yourself a test email and check it passes — most platforms flip to a green "authenticated" status once the records go live.
- Tighten DMARC gradually. After a week or two of clean reports, move to p=quarantine, then eventually p=reject. Never jump straight to reject, or you risk blocking your own legitimate mail.
Mistakes that quietly cost you
- Two SPF records. You are allowed only one SPF record per domain. If two tools send for you, merge their include values into a single line — not two separate records.
- Authenticating the wrong domain. Set these up on the exact domain you send from. If your mail goes out as news@yourbrand.com, authenticate yourbrand.com.
- Jumping to p=reject too fast. Without monitoring first, a strict policy can bounce your receipts, invoices, and the newsletter you meant to protect.
- Sending from a free address. You cannot properly authenticate mail sent as yourname@gmail.com through a marketing tool. Send from your own domain.
The other half of the equation
Two things decide whether your emails land: sending from a domain the inbox trusts, and mailing a list that is actually reachable. Authentication handles the first. If you would rather not wrangle DNS records by hand, platforms like utobo's email tools walk you through domain authentication step by step and keep the sending side clean — so you can spend your energy on what you actually want to say.
None of this requires code, and it is a one-time setup that pays off on every send afterward. Give it an afternoon, get SPF, DKIM, and DMARC in place, and you stop fighting the spam folder. Your reputation quietly starts working for you instead of against you.
Enjoyed this article?
Get product updates, tips, and company news — no spam.
Subscribe to the newsletter