SPF, DKIM and DMARC: How to Authenticate Your Emails

SPF, DKIM and DMARC: how to authenticate your emails

Authenticating your emails means proving to mailbox providers that you are the legitimate sender of your messages. It rests on three complementary standards: SPF, DKIM and DMARC. Together they stop anyone from spoofing your domain, improve your deliverability, and are now required by Gmail and Yahoo for bulk senders. This guide explains what each one is, how it works, and how to set them up with Mailpro.

Key takeaways

• SPF lists which servers are allowed to send on behalf of your domain.
• DKIM adds a cryptographic signature proving the message wasn't altered.
• DMARC ties SPF and DKIM together, tells providers what to do on failure, and sends you reports.
• Since February 2024, Gmail and Yahoo require all three from senders of more than 5,000 emails a day.
• Without authentication, your emails are filtered to spam, or rejected outright.

Why did authentication become essential?

Authentication solves a simple problem: by default, anyone can write any address in an email's "from" field. That is what makes phishing possible. SPF, DKIM and DMARC close that door by letting the server receiving your email verify that it truly comes from your domain.

Since February 2024, Gmail and Yahoo have made it mandatory: any sender pushing more than 5,000 messages a day must have SPF, DKIM and DMARC in place, offer one-click unsubscribe, and keep spam complaints very low. Non-compliant email is filtered or refused. Authentication is no longer an optional best practice, it is the entry ticket to the inbox.

SPF: who is allowed to send for your domain?

SPF (Sender Policy Framework) is a list, published in your DNS, of the servers authorized to send email on behalf of your domain. When a provider receives a message, it compares the sending server against that list. If the server is on it, SPF passes; if not, the email is suspect.

In practice, SPF is a TXT record in your DNS zone, such as v=spf1 include:_spf.mailpro.com -all. The trailing -all tells providers to reject any server not listed. SPF directly fights spoofing: nobody can claim to send from your domain without appearing in your record. Its limit is that SPF checks the technical sending domain, not always the address the recipient sees, which is why DKIM and DMARC are still needed. For a deeper look at SPF alone, see our post on what SPF is.

DKIM: the signature that guarantees integrity

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. Your sending server signs the message with a private key; the matching public key is published in your DNS. The provider receiving the email fetches that public key, verifies the signature, and confirms two things: the message really comes from your domain, and it wasn't changed in transit.

In practice the signature sits in the message header as an encryption key. The recipient never sees it, but their provider uses it to grant trust. DKIM matters especially because its validity survives an email being forwarded, where SPF can break. With Mailpro, the DKIM signature on your campaigns is handled for you.

Don't want to wrangle DNS records by hand? Mailpro guides the email authentication setup end to end.

DMARC: the layer that ties it all together

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the standard that gives SPF and DKIM meaning. It does three things. First, it checks "alignment": the domain validated by SPF or DKIM must match the domain the recipient sees. Second, it tells providers what to do when an email fails authentication, via a policy: p=none (monitor only), p=quarantine (send to spam) or p=reject (refuse). Third, it sends you regular reports on who is sending email in your name, legitimate or fraudulent.

DMARC is also published as a DNS record, on _dmarc.yourdomain.com. Best practice is to start at p=none to observe, then tighten gradually to quarantine and then reject once all your legitimate mail passes. That ramp-up is what actually protects your domain from phishing.

What about BIMI?

BIMI (Brand Indicators for Message Identification) is authentication's reward: it displays your brand logo next to your emails in the inbox. BIMI requires a DMARC policy at quarantine or reject, and often a verified brand certificate. It is a trust-and-visibility bonus, but it only makes sense once SPF, DKIM and DMARC are solidly in place.

How to set up SPF, DKIM and DMARC with Mailpro

Setup happens once, at your domain level:

• SPF: add or extend a TXT record that includes Mailpro's sending servers. One SPF record per domain, or it becomes invalid.
• DKIM: publish the public key Mailpro provides in your DNS; Mailpro's tool generates and manages the signature.
• DMARC: create the _dmarc record, start at p=none with a reporting address, then tighten the policy.

For transactional or bulk sends, our SMTP server applies this authentication to every message. And to check the work is paying off, watch your email statistics after each send.

Common mistakes to avoid

• Publishing two SPF records: a domain must have only one.
• Staying stuck at p=none: monitoring doesn't protect, you must tighten the DMARC policy.
• Forgetting a third-party tool (CRM, billing) that sends in your name without being authorized in SPF.
• Assuming authentication is enough: it opens the door, but your list quality decides whether you stay in the inbox. That's the subject of our guide to avoiding spam.

Frequently asked questions

Are SPF, DKIM and DMARC mandatory?

For bulk senders, yes. Since February 2024, Gmail and Yahoo require all three from accounts sending more than 5,000 emails a day. For small volumes they aren't strictly enforced but remain strongly recommended: without them, deliverability collapses.

What is the difference between SPF and DKIM?

SPF verifies that the sending server is authorized for your domain; DKIM verifies, via a cryptographic signature, that the message truly comes from you and wasn't altered. SPF validates the technical sender, DKIM validates the content. They are complementary, and DMARC ties them together.

Does DMARC really stop phishing?

A DMARC policy at reject stops providers from delivering emails that spoof your exact domain. It doesn't block lookalike domains, but it protects your real domain name, which sharply reduces direct impersonation.

How long until authentication is active?

DNS records usually propagate within a few hours, sometimes up to 48. Once propagated, SPF and DKIM are checked on every send; DMARC starts producing reports from the first messages.