Deliverability
SPF, DKIM and DMARC: authenticate emails and diagnose spam
Understand SPF, DKIM and DMARC, check domain alignment and troubleshoot emails in spam using Gmail, Yahoo and Outlook sender requirements.
SPF, DKIM and DMARC authenticate emails sent using your domain. SPF authorizes sending servers, DKIM signs the message and DMARC checks the relationship with the visible sender domain. They reduce some impersonation risks, but do not guarantee inbox placement.
If your emails land in spam, check authentication first, then contact quality, complaints and sending patterns. This guide covers the practical checks for small businesses and nonprofits.
What is the difference between SPF, DKIM and DMARC?
| Protocol | What it checks | What to watch |
|---|---|---|
| SPF | The server is authorized to send for the envelope domain, usually shown in Return-Path. | This may differ from the visible From address; do not publish multiple SPF records for one name. |
| DKIM | A cryptographic signature associates the message with a domain and validates signed elements. | Use the keys and selectors provided by your sending service. |
| DMARC | At least one SPF or DKIM check passes with a domain aligned to the visible From. | Publishing a record is not enough: check alignment and legitimate sending sources. |
DMARC alignment means the authenticated domain matches the visible domain under the configured strict or relaxed mode. Passing SPF on your provider’s domain alone does not establish DMARC authentication for your brand. A valid, aligned DKIM signature can satisfy it.
What do p=none, quarantine and reject mean?
p=none requests monitoring without requesting quarantine or rejection under DMARC. p=quarantine requests quarantine for failures; p=reject requests rejection. Receiving providers also apply their own rules. Configure an appropriate rua destination to receive aggregate reports.
Inventory your legitimate senders first: business mail, newsletters, invoicing and applications. Review the results before strengthening your DMARC policy so that your own messages are not accidentally blocked.
What do Gmail, Yahoo and Outlook require?
Requirements depend on the recipient service and sending volume. Bulk-sender requirements add to the rules that apply to all senders.
- Gmail: above 5,000 daily messages to personal Gmail accounts, enhanced requirements include SPF, DKIM, DMARC and alignment. Relevant marketing messages must support one-click unsubscribe.
- Yahoo: bulk senders must use SPF, DKIM and DMARC, among other requirements. Check Yahoo’s definition and rules instead of automatically applying Gmail’s threshold.
- Outlook.com: Microsoft announced SPF, DKIM and DMARC requirements for high-volume sending domains, with enforcement starting in May 2025.
A visible unsubscribe link in the message body does not, by itself, replace the technical one-click unsubscribe headers. Your sending platform must handle that mechanism.
Why do emails reach spam even when SPF and DKIM pass?
Authentication supports trust, but does not guarantee placement. Reputation, complaints, invalid addresses, content and changes in volume also influence how a message is treated.
- Inspect a received message: in Gmail, use “Show original” and review SPF, DKIM and DMARC results.
- Check alignment: compare the From domain with the DKIM signing domain and Return-Path. Results should match your configuration.
- Check DNS: record name, value, DKIM selector and absence of duplicate SPF records. Copy the values supplied for your domain, not a generic example.
- Read delivery errors: distinguish authentication rejection, nonexistent addresses and temporary limits.
- Review the audience: process complaints and suppressions, then resume gradually after a long break.
Next, read how to clean an email list. Use campaign analytics to spot changes, remembering that delivery and inbox placement are different.
Set up your sending domain with Sendora
Add your domain in Sendora and use the records displayed for your account: domain verification, DKIM keys and DMARC configuration. Publish the values with the provider that manages your DNS. An SPF record for your business mailbox does not necessarily cover other sending sources.
After publishing, rerun verification in Sendora and send a test message. Detecting DNS records and authenticating a received message are complementary checks. Propagation time depends on factors including caching and TTL.
Frequently asked questions
Can DMARC pass if SPF fails?
Yes, if DKIM passes with an aligned domain. Conversely, passing aligned SPF can satisfy DMARC. You must still meet any additional requirements of the receiving mailbox provider.
Can I copy an SPF record from an article?
No. Use your providers’ official values for your configuration. Adding an invented authorization or overwriting an existing record can disrupt legitimate mail.
Does DMARC prevent all impersonation?
No. It helps protect the visible domain when the policy is applied. It does not, by itself, stop lookalike domains, false display names or compromised accounts.
