The Complete Guide to Email Authentication: SPF, DKIM, and DMARC

This guide walks you through what each protocol does, how to set them up, and the common mistakes that silently wreck your inbox placement.

If your emails are landing in spam, chances are your domain authentication isn't set up correctly. SPF, DKIM, and DMARC are the three pillars of email authentication, and getting them right is the single most impactful thing you can do for your email deliverability.

Why Email Authentication Matters

Every time you send an email, the receiving server (Gmail, Outlook, Yahoo, etc.) asks three questions:

Is this server allowed to send emails for this domain? (SPF)
Was this email actually sent by who it claims to be from? (DKIM)
What should I do if authentication fails? (DMARC)

If you can't answer these questions convincingly, your emails are treated as suspicious. That means spam folder, or worse, outright rejection.

Think of it like showing up at a building entrance. SPF is the guest list. DKIM is your ID badge. DMARC is the security policy that tells the guard what to do when someone doesn't have proper credentials.

Part 1: SPF (Sender Policy Framework)

What SPF Does

SPF lets you publish a list of servers that are authorized to send emails on behalf of your domain. When a receiving server gets an email claiming to be from yourdomain.com, it checks your SPF record to see if the sending server is on the list.

How to Set Up SPF

SPF is a TXT record added to your domain's DNS. Here's the basic structure:

v=spf1 include:amazonses.com ~all

Breaking this down:

v=spf1 tells the server this is an SPF record
include:amazonses.com authorizes Amazon SES servers (which AutoSend uses) to send on your behalf
~all tells receiving servers to treat any other sender as suspicious (soft fail)

If you're sending from a subdomain (e.g., mail.yourdomain.com), add the SPF record to that specific subdomain, not the root domain.

If you also use another email provider (like Google Workspace for internal email), your root domain SPF might look like:

v=spf1 include:_spf.google.com include:amazonses.com ~all

SPF Qualifier Reference

The qualifier at the end of your SPF record controls what happens to emails from unauthorized servers:

Start with ~all and move to -all after a few weeks of confirmed clean delivery.

Common SPF Mistakes

Mistake 1: Multiple SPF records on the same domain
This is probably the most common SPF mistake. If your domain has two TXT records that both start with v=spf1, it will return a permerror.
Wrong:
```
v=spf1 include:amazonses.com ~all
v=spf1 include:_spf.google.com ~all
```
Correct:
```
v=spf1 include:amazonses.com include:_spf.google.com ~all
```
Merge all your authorized senders into a single SPF record.
Mistake 2: Exceeding the 10 DNS lookup limit
Every include: counts as a DNS lookup. The limit is 10, including nested includes.
If you exceed this, SPF returns permerror.
To check, use a tool like MXToolbox SPF Lookup.
Mistake 3: Using +all
This authorizes every server to send email from your domain. This is very dangerous.

Part 2: DKIM (DomainKeys Identified Mail)

What DKIM Does

DKIM adds a cryptographic signature to every outgoing email. The receiving server uses a public key published in your DNS to verify that the email wasn't tampered with in transit and that it genuinely came from your domain.

How to Set Up DKIM

DKIM setup involves two parts:

The private key stays on the sending server (AutoSend handles this for you).
The public key gets published in your DNS as a TXT or CNAME record.

Option A: CNAME record (recommended for AutoSend)

Type: CNAME
Name: autosend._domainkey
Content: autosend._domainkey.yourdomain.com.d.autosend.email

Option B: TXT record (manual key)

Type: TXT
Name: autosend._domainkey
Content: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...

Common DKIM Mistakes

Mistake 1: Missing the v=DKIM1 tag
A proper DKIM TXT record starts with v=DKIM1; k=rsa; before the public key.
Mistake 2: Using a TXT record when you should use CNAME
If your email provider gives you a CNAME, use the CNAME.

Part 3: DMARC (Domain-based Message Authentication, Reporting & Conformance)

What DMARC Does

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also gives you reporting so you can see who's sending email from your domain and whether authentication is passing or failing.

How to Set Up DMARC

Add a TXT record to your root domain:

Type: TXT
Name: _dmarc
Content: v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r;

The DMARC Policy Progression

Don't jump straight to p=reject. Follow this progression:

Week 1-2: Monitor mode

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;

Week 3-4: Quarantine mode

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100;

Week 5+: Reject mode

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100;

Common DMARC Mistakes

Mistake 1: Staying on p=none forever
Mistake 2: No rua= tag (no reporting)
Mistake 3: Misunderstanding alignment

Putting It All Together: A Complete Setup Checklist

Step 1: Set up SPF on your sending domain

Type: TXT
Name: mail (or whatever your sending subdomain is)
Content: v=spf1 include:amazonses.com ~all

Step 2: Set up DKIM

Type: CNAME
Name: autosend._domainkey
Content: (value provided by AutoSend)

Step 3: Set up DMARC on the root domain

Type: TXT
Name: _dmarc
Content: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r;

Step 4: Send a test email

Step 5: Monitor DMARC reports for 1-2 weeks

Step 6: Tighten your policies

Quick Reference: DNS Records at a Glance

Clean, minimal, and effective.

Need Help?

If you're an AutoSend customer and your emails are still landing in spam after following this guide, reach out to us. We'll check your DNS records, review your sending patterns, and help you get to the inbox.