Every email you send is judged before anyone reads it. Gmail, Outlook and every other mailbox provider run three checks - SPF, DKIM and DMARC - to decide whether your message reaches the inbox, the spam folder, or nothing at all. Since 2024, Google and Yahoo outright require them for anyone sending in volume, and Outlook followed in 2025. The full list is in our guide to Gmail and Yahoo sender requirements. The three acronyms sound like plumbing, and they are, but the ideas behind them are simple. Here they are in plain language.
The problem all three solve
Email's original design lets anyone put anything in the "from" field. Nothing technically stops a spammer from sending mail that claims to be from yourstore.com. SPF, DKIM and DMARC are three DNS records - small text entries on your domain - that together let receiving mail servers verify the mail really came from you. No verification, no trust; no trust, no inbox.
SPF: the guest list
SPF (Sender Policy Framework) is a public list of the servers allowed to send email for your domain. When a mail server receives a message claiming to be from yourstore.com, it looks up your SPF record and checks whether the sending server is on the list. On the list: pass. Not on the list: suspicious.
An SPF record is a single DNS TXT entry and reads almost like a sentence:
v=spf1 include:amazonses.com ~all
Translated: "email for this domain is sent by Amazon SES; treat everything else with suspicion." The include mechanism is how you authorise an email platform to send for you without listing individual servers.
DKIM: the wax seal
DKIM (DomainKeys Identified Mail) is a cryptographic signature attached to every email you send. Your sending platform signs each message with a private key; your DNS publishes the matching public key; the receiving server checks the signature. A valid signature proves two things at once: the mail really came from a sender with your key, and nobody altered the message in transit. Like a wax seal on a letter - if the seal is intact, the letter is genuine and unopened.
DKIM keys should rotate periodically, which is why platforms typically publish several keys via CNAME records rather than one static value.
DMARC: the instructions
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM fail - and sends you reports about it. Without DMARC, a failed check is just a hint the receiver may ignore. With it, you set policy:
- p=none - deliver anyway, but report failures to me (the monitoring stage)
- p=quarantine - send failures to spam
- p=reject - refuse failures outright
DMARC also enforces alignment: the domain that passes SPF or DKIM must match the domain in the from-address people actually see. Alignment is what stops a spammer from passing checks on their own domain while displaying yours - and it is why sending through a platform's shared domain ("via mail.someplatform.com") is weaker than authenticating your own.
How the three work together
SPF checks where the mail came from. DKIM checks that it is signed and unaltered. DMARC ties both to the visible from-address and sets the consequences. One passing check with alignment is enough for DMARC to pass, which is deliberate - forwarding often breaks SPF, and a valid DKIM signature survives it.
Check yours in five minutes
- SPF: look up the TXT record on your domain and confirm it names your actual email platform, with only one v=spf1 record present.
- DKIM: send yourself an email and use "show original" in Gmail - it displays pass or fail for all three checks per message.
- DMARC: look up the TXT record on _dmarc.yourdomain.com. If it does not exist, start with p=none and reports, then tighten.
What this looks like when it is handled for you
In MailingPlatform, domain authentication is a guided setup: you get the exact DNS records to add, live verification shows when they resolve, DKIM keys rotate automatically, and everything sends aligned on your own domain over Amazon SES infrastructure. The full picture - list hygiene, bounce feedback loops, one-click unsubscribe compliance - is on the deliverability page. Authentication is the entry ticket; what you send and to whom decides the rest, which is where a proper welcome series and honest list practices come in.
