Email Marketing
SPF, DKIM and DMARC setup without breaking your email.
SPF, DKIM and DMARC prove that mail claiming to come from your domain really did. Mailbox providers rely on them, and mistakes silently send real mail to spam. We inventory every sender, publish correct records and move to enforcement in stages.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Mail from your domain lands in spam or is rejected
- You send from several tools such as a CRM, a store, a helpdesk and a newsletter platform
- You see SPF 'too many lookups' or 'permerror' in a checker
- Your DMARC record is missing or stuck at monitoring only
- Someone is spoofing your domain or you want to prevent it
What you get
- A sender inventory for your domain
- Corrected SPF, DKIM and DMARC records, documented
- DMARC report monitoring and a plain-English summary
- A staged enforcement plan with a rollback note
How We Do It
A clear process you can follow along with.
1. Inventory every sender
We list every system that sends mail as your domain: the mailbox provider, marketing platform, store, CRM, helpdesk, billing and forms. Forgotten senders are the main reason strict policies break real mail.
2. Read the existing DNS records
We look up the current SPF TXT record, DKIM selectors and any DMARC record. Having more than one SPF record is invalid, and we find and merge duplicates.
3. Fix SPF
We combine authorized senders into a single record, remove ones you no longer use and keep within the DNS lookup limit that SPF specifies. Where we hit the limit, we prune includes rather than guess.
4. Enable DKIM on every platform
Each sender gives us its own DKIM records, usually CNAME or TXT entries. We publish them, confirm the platform shows the domain as verified and send test mail to confirm signing.
5. Publish DMARC in monitoring mode
We add a DMARC record with a policy that only monitors, plus a reporting address. We read the aggregate reports to find legitimate senders failing alignment.
6. Fix alignment issues
DMARC needs SPF or DKIM to pass and align with the visible From domain. We set up custom return-path and branded sending domains where a tool needs them.
7. Move to enforcement in stages
When reports are clean, we step the policy up, first quarantine and then reject, optionally using a gradual percentage, and keep watching reports for new senders.
Mistakes We Help You Avoid
Common ways this goes wrong, and what we do instead.
Two SPF records
A domain must have only one SPF record. We merge them.
Jumping straight to reject
Enforcing before you know your senders blocks legitimate mail. We monitor first.
Forgetting subdomains
Tools often send from a subdomain with its own records. We check each one.
Treating DNS as set and forget
New tools add new senders. We recommend a recheck whenever a sending system changes.
Frequently Asked Questions
What is the difference between SPF, DKIM and DMARC?
SPF lists servers allowed to send for a domain. DKIM adds a cryptographic signature to each message. DMARC tells receivers what to do when checks fail and sends you reports.
Will DMARC fix my spam problem alone?
No. It proves identity but does not guarantee inbox placement. Content, list quality and complaint rates still matter.
Do I need DMARC for bulk sending?
Major mailbox providers expect authentication for bulk senders, and DMARC is part of that for many. Check each provider's current sender guidelines for details.
Want Help With SPF, DKIM and DMARC setup without breaking your email?
Schedule an appointment. Tell us about your business and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required