--- type: "Blog Post" title: "What are DMARC, SPF and DKIM? Setup guide | Roicool" description: "What DMARC, SPF and DKIM are and how to set them up: Gmail and Yahoo sender rules, DMARC policies and the steps that keep your email out of spam folders." url: "https://www.roicool.com/en/blog/what-are-spf-dkim-dmarc" lang: "en" dateModified: "2026-10-20" author: "Semih Bayındır" resource: "https://www.roicool.com/en/blog/what-are-spf-dkim-dmarc" alternates: tr: "https://www.roicool.com/blog/dmarc-spf-dkim-nedir.md" generated: { by: "process:roicool-cms", at: "2026-10-20T15:59:07.613Z" } related: - { title: "What is Apollo.io? Setup and use for B2B prospecting", resource: "https://www.roicool.com/en/blog/what-is-apollo-io.md" } - { title: "WhatsApp conversion tracking: measuring messages from ads", resource: "https://www.roicool.com/en/blog/whatsapp-conversion-tracking.md" } - { title: "What is Clay? How it works, pricing and when to use it", resource: "https://www.roicool.com/en/blog/what-is-clay.md" } sources: - { id: "1", resource: "https://senders.yahooinc.com/best-practices/", title: "Yahoo Sender Hub, Best practices" } - { id: "2", resource: "https://techcommunity.microsoft.com/blog/outlook/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730", title: "Microsoft Tech Community, Outlook's new requirements for high-volume senders" } - { id: "3", resource: "https://www.rfc-editor.org/rfc/rfc7208", title: "RFC 7208, Sender Policy Framework (SPF)" } - { id: "4", resource: "https://www.rfc-editor.org/rfc/rfc6376", title: "RFC 6376, DomainKeys Identified Mail (DKIM) Signatures" } - { id: "5", resource: "https://www.rfc-editor.org/rfc/rfc7489", title: "RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)" } - { id: "6", resource: "https://support.google.com/a/answer/81126", title: "Google Workspace Admin Help, Email sender guidelines" } - { id: "7", resource: "https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6563.pdf", title: "Law No. 6563 on the Regulation of Electronic Commerce (Turkey)" } --- # What are DMARC, SPF and DKIM? Why your emails land in spam SPF, DKIM and DMARC are DNS records. SPF defines which servers may send email on behalf of your domain; DKIM proves the message came from your domain and was not altered in transit; DMARC tells receivers what to do with messages that fail those two checks. Since 2024, Gmail and Yahoo require all three from bulk senders. - SPF defines authorized servers, DKIM the signature, DMARC the policy. - Since February 2024, Gmail and Yahoo require all three from bulk senders. - DMARC starts at p=none and is tightened once you have read the reports. - A domain gets one SPF record, and there is a 10 DNS lookup limit. - Track your spam complaint rate regularly in Google Postmaster Tools. SPF, DKIM and DMARC are three DNS records that prove to a receiving server that an email really comes from your domain. SPF lists the servers allowed to send on behalf of your domain. DKIM adds a digital signature to the message. DMARC tells receivers what to do with messages that fail the first two, and sends you reports. If all three are not fully in place, even the best-written email can end up in the spam folder. ## Why are they mandatory now? From February 2024, Google and Yahoo tightened authentication rules for email senders. Bulk senders that send close to 5,000 or more messages a day to Gmail addresses must set up SPF, DKIM and DMARC together, align the From address domain with these checks, and offer one-click unsubscribe in marketing messages. Smaller senders still need SPF or DKIM. Microsoft followed: from May 5, 2025, it requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses, and non-compliant messages are first routed to the Junk folder. In other words, DMARC is no longer a "best practice". It is a baseline requirement for B2B email and outbound. ## SPF: who can send? SPF (Sender Policy Framework) is a TXT record added to your domain's DNS. It lists the servers or services allowed to send email on behalf of your domain. v=spf1 include:\_spf.google.com include:servers.mcsv.net ~all Two rules matter: a domain has only **one** SPF record, and evaluating that record may take at most **10 DNS lookups**. Companies that use many sending services often exceed this limit, and SPF quietly fails. ## DKIM: was the message changed? DKIM (DomainKeys Identified Mail) means the sending server adds a digital signature to every message using a private key. The public key needed to verify the signature lives in your domain's DNS, in a record of the form `selector._domainkey.yourdomain.com`. The receiving server checks the signature; if the message was altered in transit or sent from somewhere else, the signature does not match. DKIM has to be enabled separately for each sending service (Google Workspace, Microsoft 365, your email marketing tool, your outbound tool). ## DMARC: what happens to messages that fail? DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at `_dmarc.yourdomain.com`. It does two jobs: it tells receivers what to do with messages that fail SPF or DKIM and are not aligned with the From address, and it sends you authentication reports. v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com | Policy | What happens | When | | --- | --- | --- | | `p=none` | The message is delivered normally and only reported | Start and monitoring phase | | `p=quarantine` | The message goes to the spam folder | Once legitimate sources are fixed | | `p=reject` | The message is rejected | When every source passes authentication | ## Step-by-step setup 1. **List your sending sources.** Who sends email on behalf of your domain? Corporate email, marketing tool, CRM, support desk, billing system, outbound tool. 2. **Merge SPF into one record.** Add every source to a single record and check the lookup count. 3. **Enable DKIM for each source.** Add the DKIM record each service gives you to DNS and turn signing on. 4. **Publish DMARC with p=none.** Set a reporting address and use a DMARC report tool to read the reports. 5. **Read the reports.** Over a few weeks, see which sources fail authentication and fix them. 6. **Tighten the policy.** First `quarantine`, then `reject`. 7. **Monitor your reputation.** Check your spam complaint rate and domain reputation regularly in Google Postmaster Tools. ## Extra notes for cold email Outbound teams usually protect the main domain by sending from a separate domain, warming the new domain up with low volume and capping daily sends per mailbox. The authentication records must be fully set up for that domain too. In Turkey, commercial electronic messages are governed by Law No. 6563 on the Regulation of Electronic Commerce and its regulation; the rules and İYS (Turkey's commercial message consent registry) obligations differ depending on whether the recipient is a business or a consumer, so get legal advice before a campaign. For recipients in Europe, GDPR must be assessed as well. To pinpoint email delivery problems, our [email deliverability](https://www.roicool.com/en/services/email-deliverability) entry product audits your domain's authentication and reputation. The full lead generation process, outbound included, is on our [B2B lead generation agency](https://www.roicool.com/en/services/lead-generation-agency) page. ## Sources 1. [Yahoo Sender Hub, Best practices](https://senders.yahooinc.com/best-practices/), 2024 2. [Microsoft Tech Community, Outlook's new requirements for high-volume senders](https://techcommunity.microsoft.com/blog/outlook/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730), 2025 3. [RFC 7208, Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208), 2014 4. [RFC 6376, DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376), 2011 5. [RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc7489), 2015 6. [Google Workspace Admin Help, Email sender guidelines](https://support.google.com/a/answer/81126), 2024 7. [Law No. 6563 on the Regulation of Electronic Commerce (Turkey)](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6563.pdf), 2014 ## FAQ ### Who counts as a bulk sender under Gmail's rules? Since February 2024, Google treats anyone sending close to 5,000 or more messages a day to Gmail addresses as a bulk sender. Bulk senders must set up SPF, DKIM and DMARC, and marketing messages must offer one-click unsubscribe. Smaller senders still need SPF or DKIM. ### Should I set DMARC to p=reject right away? No. Start with p=none and watch the reports for a few weeks to see who sends email on behalf of your domain and which sources fail authentication. Once every legitimate source is fixed, move to quarantine, then to reject. ### Can a domain have more than one SPF record? No. A domain should have exactly one SPF record; multiple records make SPF fail. Merge all your sending services into a single record and keep an eye on the 10 DNS lookup limit. ### Should I use my main domain for cold email? Sending high-volume cold email from your main domain can hurt delivery of the company's everyday email if complaint and spam rates rise. Many teams use a separate, properly configured domain for outbound. Either way, SPF, DKIM and DMARC must be fully set up. Breadcrumb: [Home](https://www.roicool.com/en) › [Blog](https://www.roicool.com/en/blog) › [Lead generation](https://www.roicool.com/en/blog/category/lead-generation) › What are DMARC, SPF and DKIM? Why your emails land in spam Related pages: - [What is Apollo.io? Setup and use for B2B prospecting](https://www.roicool.com/en/blog/what-is-apollo-io) - [WhatsApp conversion tracking: measuring messages from ads](https://www.roicool.com/en/blog/whatsapp-conversion-tracking) - [What is Clay? How it works, pricing and when to use it](https://www.roicool.com/en/blog/what-is-clay) Source: https://www.roicool.com/en/blog/what-are-spf-dkim-dmarc · Last updated: 2026-10-20