Key Takeaways
- SPF, DKIM, and DMARC are now enforced. Gmail and Yahoo require them since February 2024, and Outlook since May 2025, for bulk senders.
- The single most common mistake is publishing two SPF records. RFC 7208 allows only one; if two exist, both become invalid and authentication fails.
- SPF is capped at 10 DNS lookups. Combining several sending tools easily exceeds it, which silently breaks SPF. SPF flattening is the fix.
- Roll DMARC out in phases: p=none to monitor, then p=quarantine, then p=reject, over 4 to 8 weeks. Move forward only after reading the reports.
Email authentication stopped being optional in 2024. Gmail and Yahoo began enforcing it in February of that year, Microsoft followed for Outlook in May 2025, and by 2026 authentication failures are among the fastest ways to get a domain deferred or blocked, regardless of send volume. SPF, DKIM, and DMARC setup is the entry ticket to the inbox, and getting it wrong is one of the most common and most invisible causes of deliverability problems. This guide covers what to publish, how to roll it out safely, and the specific mistakes that break authentication without any obvious error.
A useful mental model: SPF is the guest list (which servers may send for you), DKIM is the wax seal (proof the message was not altered), and DMARC is the bouncer (the policy deciding what happens when a check fails, plus the reports that tell you who is sending as you).
SPF: The One-Record, Ten-Lookup Rules
SPF is a single DNS TXT record listing every server authorized to send mail for your domain. Two rules govern it, and both are common failure points.
Rule one: only one SPF record per domain. This is the single most frequent setup mistake. Teams add a new tool's SPF as a separate TXT record instead of merging it into the existing one. Per RFC 7208, if two records start with v=spf1, SPF returns an error and both become invalid, breaking authentication for the entire domain. The fix is to merge all includes into one record.
Rule two: a hard cap of 10 DNS lookups. Mechanisms like include, a, mx, redirect, exists, and ptr each count toward the limit; ip4, ip6, and all do not. Combine Google Workspace, a marketing platform, a CRM, and a help desk, and you can hit 10 lookups fast. Over the limit, SPF fails even for legitimate mail. The fix is SPF flattening, which rewrites the record to stay under the cap.
Before publishing anything, inventory every system that sends mail as your domain: the email host, marketing platforms, the CRM, transactional senders, and any SaaS app that sends notifications as you. SPF only authorizes what you list.
DKIM: Keys, Selectors, and Rotation
DKIM adds a cryptographic signature to every outgoing message, which the receiving server checks against a public key you publish in DNS. Your email provider generates the key pair and gives you the DNS records to add; you do not create the keys manually.
The common DKIM mistakes are using weak keys, misconfigured selectors, and skipping verification. Use 2048-bit keys, which most providers now expect, and rotate them roughly every six months for security. After publishing the DNS record, you must enable signing in the provider panel; publishing the record alone does not sign mail. Confirm it works by sending a test to a Gmail address, opening Show original, and checking for dkim=pass with your domain.
DMARC: The Phased Rollout
DMARC ties SPF and DKIM together with a policy and a reporting layer. It passes when either SPF or DKIM is valid and aligned with the visible From domain, and it tells receivers what to do on failure. The critical concept is alignment: the authenticated domain must match the From header, or DMARC fails even when SPF and DKIM individually pass.
Never jump straight to enforcement. Roll DMARC out in three phases over 4 to 8 weeks:
- p=none (monitor): Publish with reporting on. This blocks nothing and is safe to deploy immediately. Read the aggregate reports to find every legitimate sender before tightening.
- p=quarantine: After a few weeks of clean reports, move failing mail to spam. Watch for any legitimate sender you missed.
- p=reject: Once you are confident every legitimate sender is authenticated, reject failing mail outright. This is full enforcement and the goal state.
DMARC aggregate reports arrive as raw XML, which is painful to read without tooling. The fields that matter are the source IP, the volume, the disposition, and the per-record SPF and DKIM results. Use these to spot unauthorized senders before moving from monitoring to enforcement. Also remember subdomains: set the sp= tag to apply a policy to subdomains, or they remain unprotected.
Authentication Protects the Domain, Verification Protects the Reputation
Perfect authentication will not save a domain that sends to garbage data. The two work together: authentication proves the mail is really from you, and list quality keeps your bounce and complaint rates low enough that providers keep trusting you. A domain with flawless SPF, DKIM, and DMARC can still land in spam if it is blasting an unverified list with a high bounce rate.
Run lists through the email verification API before sending so authentication and clean data reinforce each other. The email verification API documentation covers the bulk flow for pre-send cleaning, the free email verification tool handles individual checks while you debug delivery problems, and new accounts get 100 free email verification credits to verify a sample. Authentication is the entry ticket; verification keeps the seat.
Frequently Asked Questions
Can I have more than one SPF record?
No. RFC 7208 allows exactly one SPF record per domain. If two TXT records start with v=spf1, SPF fails entirely, not cumulatively. Merge all your include and ip4 mechanisms into a single record. This is the most common authentication mistake.
What DMARC policy should I start with?
Start with p=none, which monitors and reports without blocking anything. Read the aggregate reports for a few weeks to identify every legitimate sender, then move to p=quarantine, and finally to p=reject. The full rollout typically takes 4 to 8 weeks because you need monitoring windows between stages.
Why does my SPF fail even though the record looks correct?
Usually the 10-DNS-lookup limit. Mechanisms like include, a, mx, and ptr each count, and combining several sending tools exceeds the cap, which makes SPF fail for all mail. Check your lookup count and use SPF flattening to stay under 10.
Do small senders need DMARC, or just bulk senders?
Bulk senders (5,000+ messages per day to Gmail or Yahoo) are required to have all three. But spoofing protection has no volume threshold, and unauthenticated mail from smaller senders increasingly lands in spam too. Every sender benefits from SPF, DKIM, and DMARC at p=reject.