The problem all three solve
Email was designed without any way to verify who sent a message. Anyone can put your address in the From field, which is why phishing works. The three records below are the retrofit: together they let a receiving server check that mail claiming to come from your domain really did.
For a sales team the stakes are practical rather than theoretical. Mail that cannot be authenticated is treated with suspicion, and suspicion means the spam folder — where a well-written email performs exactly as badly as a terrible one.
SPF — who is allowed to send
A DNS record listing the servers permitted to send mail for your domain. A receiving server looks up the list and checks whether the message came from one of them.
The mistake that catches people: SPF has a hard limit of ten DNS lookups, and each service you authorise can consume several. Add Google Workspace, a marketing tool, a helpdesk and an invoicing system and you can quietly exceed it — at which point SPF fails for everything, including the mail that was fine yesterday. Also note you may only have one SPF record per domain; two is a misconfiguration, not double the coverage.
DKIM — a signature on every message
Your sending server signs each message with a private key; the matching public key sits in your DNS. The receiver verifies the signature, which proves both that the message came from an authorised sender and that nothing was altered in transit.
DKIM survives forwarding, which SPF frequently does not — a forwarded message arrives from the forwarder's server and fails an SPF check while its DKIM signature stays valid. That is a large part of why you need both.
DMARC — the policy, and the reports
DMARC does two things. It tells receiving servers what to do with mail that fails SPF and DKIM, and it asks them to send you reports about what they saw.
| Policy | Means |
|---|---|
| p=none | Do nothing, just report. Where everyone starts. |
| p=quarantine | Send failures to spam. |
| p=reject | Refuse failures outright. |
The reports are the underrated half. Before changing anything, p=none will show you every service sending as your domain — including the three nobody remembered and the one that is not yours.
The order to do it in
- 1Publish SPF listing everything that legitimately sends for you.
- 2Enable DKIM in your mail provider and publish the key.
- 3Publish DMARC at
p=noneand read the reports for a few weeks. - 4Fix whatever is failing that should not be.
- 5Move to
p=quarantine, then top=rejectonce the reports are clean.
Do not start at p=reject. You will block your own invoicing system on a Friday afternoon and find out on Monday.
What authentication does not fix
It proves you are who you say you are. It does not make you welcome. A perfectly authenticated domain sending unwanted mail to bought lists will still be filtered, because engagement — replies, opens, and crucially the absence of spam complaints — is what determines placement once identity is settled.
Authentication gets you considered. Relevance gets you delivered.
Related: why open rates cannot be trusted, which explains why deliverability is hard to measure with the numbers most tools show you.