Documentation › Sending Infrastructure

Setting Up SPF, DKIM, and DMARC

8 min read

SPF, DKIM, and DMARC are three DNS records that authenticate your sending domain and protect your email deliverability. Without them, your emails are more likely to land in spam — and major providers like Gmail and Yahoo now require them for any bulk sending.

This guide explains what each record does and how to set them up for your domain.

Why these records matter

When you send an email, the receiving mail server has no way to know if it really came from you — or from a spammer pretending to be you. SPF, DKIM, and DMARC solve this problem by letting you publish cryptographic proof in your DNS that says "emails from my domain should only come from these servers, signed with this key."

Gmail and Yahoo made SPF, DKIM, and DMARC mandatory in 2024 for anyone sending more than 5,000 emails per day. Even below that threshold, having all three set up correctly is essential for good inbox placement.

SPF — Sender Policy Framework

SPF tells receiving mail servers which IP addresses and services are allowed to send email on behalf of your domain.

How it works

You add a TXT record to your domain's DNS that lists your authorized senders. When a mail server receives an email from your domain, it checks your DNS to see if the sending server is on your approved list.

What your SPF record looks like

Your sending provider will give you the exact record to add. For Amazon SES it looks like:

If you send from multiple providers (e.g. Amazon SES for campaigns and Google Workspace for regular email), you combine them in one record:

The ~all vs -all ending

~all (softfail) means emails from unlisted servers will be accepted but flagged. -all (hardfail) means they'll be rejected outright. Start with ~all while getting set up, then consider switching to -all once everything is confirmed working.

DKIM — DomainKeys Identified Mail

DKIM adds a cryptographic signature to every email you send. The receiving server can verify this signature using a public key stored in your DNS — proving the email wasn't tampered with in transit and genuinely came from your domain.

How to set it up

Your sending provider generates a DKIM key pair for you. You publish the public key as a TXT record in your DNS. For Amazon SES, you'll add three CNAME records that look like:

The exact records are generated by your provider — copy them exactly as shown. After adding them, DNS propagation usually takes a few minutes to an hour.

DMARC — Domain-based Message Authentication

DMARC builds on SPF and DKIM by telling receiving mail servers what to do when an email fails authentication — and optionally sending you reports about what's happening with your domain's email.

How to set it up

Add a TXT record to your DNS at _dmarc.yourdomain.com:

The p= policy options

Start with p=none to collect reports without affecting delivery. Once you've confirmed your legitimate emails are passing SPF and DKIM, move to p=quarantine, then eventually p=reject.

DMARC reporting

The rua= tag tells mail servers where to send aggregate reports about your domain's email activity. These reports show you which servers are sending email using your domain — including any spammers spoofing you. Add an email address you control to receive these reports.

Verifying your setup

After adding all three records, verify them using a free tool like MXToolbox or DMARC Inspector. Search for your domain and check that SPF, DKIM, and DMARC all show as passing.

In Aledamail, go to Sending Domains to see the authentication status of your domain directly in the platform.