← Field notes

SPF, DKIM, DMARC — stop landing in spam

emaildnsdeliverability

Nobody’s emails “just” go to spam. There’s always a reason, and it’s almost always the same three records missing from your DNS.

The three records

  • SPF tells receiving servers which IPs are allowed to send mail for your domain. Without it, anyone can forge your address.
  • DKIM signs every outgoing message with a key so the recipient can prove it wasn’t tampered with in transit.
  • DMARC tells servers what to do when a message fails SPF or DKIM, and gives you reports when something tries to spoof you.

A domain with all three configured passes authentication at every major provider. A domain with none gets filtered as suspicious before a human ever sees it.

The setup that fixes it

Configure all three through Cloudflare DNS, then send a test email to mail-tester.com and read the score:

  1. Add the SPF TXT record — v=spf1 include:_spf.google.com ~all for Workspace, or your provider’s equivalent.
  2. Generate a DKIM key in your mail provider, add it as a TXT record, and enable signing.
  3. Publish a DMARC record — start with p=none to monitor, then tighten to p=quarantine once reports look clean.

The result should be a 10/10 on mail-tester and, more importantly, a sender reputation that compounds instead of decays.

The part people skip

Records get you through the door. Reputation keeps you in. Warm up new domains slowly, don’t buy lists, and keep your open-rate honest. Deliverability is a habit, not a one-time fix.