SPF, DKIM, and DMARC are three DNS records that prove your email actually came from you. That’s the whole concept. SPF is the guest list of servers allowed to send for your domain. DKIM is a tamper-proof signature on each message. DMARC is the instruction telling inboxes what to do when either check fails, and the reporting that shows you who’s sending as you.
Since the Gmail and Yahoo sender requirements took effect in 2024, and Microsoft began enforcing its own version for high-volume senders to Outlook addresses in May 2025, this stopped being optional hygiene. Bulk senders without proper authentication get filtered or rejected outright, before content, design, or reputation ever get a vote. The good news: this is a one-time setup measured in an afternoon, not an IT project. Here’s each record in plain English, why inboxes demand all three, and how to check yours in ten minutes.
What does each record actually do?
SPF: the guest list. An SPF record is a line in your domain’s DNS that lists which servers are authorized to send email on your domain’s behalf: your ESP, your helpdesk, your store platform. When your email arrives, the receiving inbox checks the sending server against that list. On the list, pass. Not on the list, suspicion. One common failure mode: SPF allows only ten lookups, and brands stacking tools (Klaviyo, Google Workspace, helpdesk, reviews platform) quietly blow past the limit, which breaks the record for everything. If you’ve added tools over the years and never touched DNS, this is worth checking first.
DKIM: the wax seal. DKIM attaches an encrypted signature to every email you send, generated with a private key only your sending platform holds. The receiving inbox verifies it against the public key published in your DNS. If the message was altered in transit, or sent by someone who doesn’t hold your key, the seal breaks. Passing DKIM says two things at once: this really came from the claimed sender, and nobody tampered with it on the way.
DMARC: the policy and the security camera. DMARC is the record that makes the other two mean something. It tells receiving inboxes what to do when a message fails authentication, and it sends you reports on every server in the world claiming to send as your domain. The policy comes in three strengths:
- p=none: monitor only. Failures still deliver, but you get the reports. This is the correct starting point, and where most brands should sit for a few weeks while they confirm every legitimate sender passes.
- p=quarantine: failures go to spam.
- p=reject: failures get refused entirely. The end state once you’re confident, and the setting that actually stops criminals from spoofing your domain to phish your customers.
The 2024 rules require bulk senders to have DMARC in place at minimum p=none. A missing DMARC record isn’t a technicality anymore; it’s a filtering decision Gmail makes for you.
Why do inboxes care this much?
Because “from” addresses are trivially fakeable, and always have been. Anyone can send an email claiming to be yourbrand.com; authentication is the only mechanism that separates you from the impersonator. Inboxes stopped giving unauthenticated mail the benefit of the doubt because the doubt was being exploited at industrial scale.
There’s a direct brand-protection angle too. Without DMARC at enforcement, criminals can spoof your exact domain to phish your own customers, and the resulting complaints and blocklist entries land on your reputation. Authentication isn’t just deliverability plumbing. It’s the lock on your brand’s front door, and the DMARC reports are the camera footage showing who’s been trying the handle.
And one alignment detail that trips up half the setups we see: it’s not enough for SPF and DKIM to pass somewhere. DMARC requires the passing domain to match the domain in your visible from address. This is exactly why sending from a shared ESP domain fails the standard: the authentication passes for the ESP’s domain, not yours, and DMARC sees a mismatch.
The dedicated sending domain: the fix behind the fix
Which brings us to the structural upgrade underneath all three records: sending from your own branded, dedicated domain rather than shared ESP infrastructure. On a shared domain, your reputation is pooled with strangers, and their bad behavior taxes your inbox placement. On a dedicated domain, aligned SPF, DKIM, and DMARC all point at you, and your reputation is yours alone to build.
This isn’t theoretical for us. When we first scored one UK wellbeing brand’s account, the deliverability system came back at 68: a shared sending domain, invalid DKIM, and missing DMARC, exactly the trio this post exists to prevent. Fixing the foundation, dedicated domain, aligned authentication, proper warming, was phase one of the rebuild, and the account’s deliverability score climbed from 74 to 91 over the following months. Authentication didn’t produce that revenue by itself. It made every send after it eligible to.
Authentication doesn’t get you into the inbox. It gets you considered for the inbox. Skipping it means the bouncer never checks your ID because you never got in the line.
The ten-minute self-check
No IT department required:
- In Klaviyo: open your sending domain settings. If you’re still on shared Klaviyo infrastructure, that’s finding number one, and it outranks the rest.
- Check your records: any free DMARC/SPF lookup tool will read your domain’s DNS in seconds. You’re looking for: an SPF record that includes your actual senders and stays under the lookup limit, a valid DKIM selector for each sending platform, and a DMARC record that exists at all.
- Read the policy: if DMARC exists, note the p= value. p=none with months of reports and no review is monitoring theater; the point of none is to graduate from it.
- Send yourself a test: in Gmail, open the message, click “show original,” and look for SPF: PASS, DKIM: PASS, DMARC: PASS. Three passes with your own domain on them is the goal state.
Anything failing that check is a DNS edit away from fixed, and it’s a permanent fix: set correctly once, these records just work. This is also why authentication sits inside the deliverability system of our audit, among the checkpoints that gate everything downstream: flows, campaigns, and every dollar they claim.
Related reading: BIMI: Getting Your Logo in the Inbox (And Whether It’s Worth It), Gmail’s Promotions Tab: Escape Attempts, Ranked by Honesty.
Moving platforms or fixing authentication? Our Klaviyo migration and setup service handles the technical side, deliverability included.
Quick answers
What’s the difference between SPF, DKIM, and DMARC? SPF lists the servers allowed to send for your domain. DKIM cryptographically signs each message. DMARC sets the policy for failures, requires domain alignment, and reports on everyone sending as you.
Do I need all three? Yes. The 2024 Gmail and Yahoo requirements expect bulk senders to authenticate with SPF and DKIM and publish DMARC at minimum. Any missing piece costs you placement before content is even evaluated.
What DMARC policy should I use? Start at p=none and read the reports until every legitimate sender passes aligned. Then move to quarantine, then reject. Parking at none forever protects nothing.
Want to know if your mail is actually arriving? The free Health Score checks authentication, sending domain, complaint signals, and list hygiene among 75+ checkpoints across 8 systems, and prices every leak in dollars. Delivered within 72 hours of access. Get your Health Score →
