What are DMARC, SPF and DKIM? Why your emails land in spam

SPF, DKIM and DMARC are three DNS records that prove to a receiving server that an email really comes from your domain. SPF lists the servers allowed to send on behalf of your domain. DKIM adds a digital signature to the message. DMARC tells receivers what to do with messages that fail the first two, and sends you reports. If all three are not fully in place, even the best-written email can end up in the spam folder.

Why are they mandatory now?

From February 2024, Google and Yahoo tightened authentication rules for email senders. Bulk senders that send close to 5,000 or more messages a day to Gmail addresses must set up SPF, DKIM and DMARC together, align the From address domain with these checks, and offer one-click unsubscribe in marketing messages. Smaller senders still need SPF or DKIM. Microsoft followed: from May 5, 2025, it requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses, and non-compliant messages are first routed to the Junk folder.

In other words, DMARC is no longer a "best practice". It is a baseline requirement for B2B email and outbound.

SPF: who can send?

SPF (Sender Policy Framework) is a TXT record added to your domain's DNS. It lists the servers or services allowed to send email on behalf of your domain.

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Two rules matter: a domain has only one SPF record, and evaluating that record may take at most 10 DNS lookups. Companies that use many sending services often exceed this limit, and SPF quietly fails.

DKIM: was the message changed?

DKIM (DomainKeys Identified Mail) means the sending server adds a digital signature to every message using a private key. The public key needed to verify the signature lives in your domain's DNS, in a record of the form selector._domainkey.yourdomain.com. The receiving server checks the signature; if the message was altered in transit or sent from somewhere else, the signature does not match.

DKIM has to be enabled separately for each sending service (Google Workspace, Microsoft 365, your email marketing tool, your outbound tool).

DMARC: what happens to messages that fail?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It does two jobs: it tells receivers what to do with messages that fail SPF or DKIM and are not aligned with the From address, and it sends you authentication reports.

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Step-by-step setup

1. List your sending sources. Who sends email on behalf of your domain? Corporate email, marketing tool, CRM, support desk, billing system, outbound tool.
2. Merge SPF into one record. Add every source to a single record and check the lookup count.
3. Enable DKIM for each source. Add the DKIM record each service gives you to DNS and turn signing on.
4. Publish DMARC with p=none. Set a reporting address and use a DMARC report tool to read the reports.
5. Read the reports. Over a few weeks, see which sources fail authentication and fix them.
6. Tighten the policy. First quarantine, then reject.
7. Monitor your reputation. Check your spam complaint rate and domain reputation regularly in Google Postmaster Tools.

Extra notes for cold email

Outbound teams usually protect the main domain by sending from a separate domain, warming the new domain up with low volume and capping daily sends per mailbox. The authentication records must be fully set up for that domain too. In Turkey, commercial electronic messages are governed by Law No. 6563 on the Regulation of Electronic Commerce and its regulation; the rules and İYS (Turkey's commercial message consent registry) obligations differ depending on whether the recipient is a business or a consumer, so get legal advice before a campaign. For recipients in Europe, GDPR must be assessed as well.

To pinpoint email delivery problems, our email deliverability entry product audits your domain's authentication and reputation. The full lead generation process, outbound included, is on our B2B lead generation agency page.