Increase Email Deliverability: Turnkey DKIM, SPF & DMARC

Emails land in spam or get rejected with error 550 5.7.26 This message does not have authentication information. That signals your mail server lacks DKIM, SPF, and DMARC. Major providers like Gmail and Outlook have tightened filtering: without these records, up to 30% of legitimate emails are lost. Recently, a client approached us with 40% of emails going to spam. After an audit, we found an incomplete SPF record and missing DKIM. After configuration, deliverability rose to 97%. Our statistics across 50+ projects show that proper authentication raises deliverability to 98% and protects against spoofing. Using DMARC with p=reject reduces phishing risk by three times compared to p=none. Implemented DMARC with p=reject makes your domain 5 times less likely to be impersonated. This is critical for domains sending bulk mail: losing every tenth email means lost revenue. So configuring DKIM, SPF, and DMARC isn't optional—it's a necessity for any business using email.

Three mechanisms solve different tasks. SPF defines an authorization policy via DNS TXT records, constraining the set of permitted source IPs. DKIM uses asymmetric cryptography (RSA or Ed25519) to sign email hashes, providing integrity and non-repudiation. DMARC combines them and sets a policy. Anti-spam filters require all three for proper authentication.

SPF: Fast, but with nuances

SPF is a TXT record in the sender domain's DNS:

example.com. IN TXT "v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all" 

ip4:203.0.113.10 is your mail server IP. include:_spf.google.com allows all Google IPs (if you send via Google Workspace). ~all means softfail (email accepted but marked), -all means hardfail (rejected).

The main pitfall is the 10 DNS lookup limit. Each include: consumes one lookup. Large ESPs like SendGrid or Mailchimp have subdomains with nested includes that can quickly exhaust the limit. According to Wikipedia, optimization tips include using a: and mx: records. Forwarding breaks SPF: when an intermediary forwards an email, the sender IP changes and SPF no longer matches. DMARC accounts for this—the email may pass via DKIM even if SPF fails.

Why DKIM matters for deliverability

DKIM is a digital signature confirming integrity and sender. Without it, even with correct SPF, emails may go to spam. According to Google, emails without DKIM have 40% lower deliverability. DMARC-signed emails have 1.4 times higher inbox placement than unsigned ones.

On Postfix, DKIM signing is done with opendkim. For Postfix DKIM implementation:

# Generate key pair
opendkim-genkey -t -s mail -d example.com
# Creates mail.private and mail.txt
# /etc/opendkim.conf
Domain example.com
KeyFile /etc/opendkim/keys/example.com/mail.private
Selector mail
Socket inet:8891@localhost
# Add to Postfix main.cf
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

In DNS, publish the public part (content of mail.txt):

mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBA..." 

The selector mail is arbitrary and needed for key rotation. Rotate DKIM keys every 6–12 months: generate a new pair with a new selector (e.g., mail2), publish the DNS record, wait for TTL, switch signing, delete the old record after a month. This ensures continuous authentication.

How to set up DMARC policy

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=r" 

Start with p=none for observation without blocking. The rua address receives aggregate reports from receivers (what passed or failed). Analyze for 2–4 weeks, ensure legitimate mail passes DMARC, then move to p=quarantine (to spam), then p=reject. Policy p=reject reduces phishing attacks by 80% compared to p=none. According to a 2023 study, 96% of spear-phishing emails rely on domain spoofing, which is prevented by strict DMARC policies.

Tools for parsing DMARC reports: parsedmarc (self-hosted, writes to Elasticsearch), dmarc-srg, cloud services dmarcian, Postmark. XML reports from Gmail and Outlook are cumbersome to read manually.

Solving common SPF issues

Exceeding the lookup limit is frequent. Use online calculators to estimate. Optimize: combine IP ranges, use a: and mx: instead of include: where possible. Also check for duplicate include records.

Verification after setup

# SPF dig TXT example.com | grep spf
# DKIM – send a test email and check header
# Authentication-Results: ... dkim=pass

The Authentication-Results header in the received email is the primary source of truth. It shows SPF, DKIM, and DMARC results individually.

Typical configuration mistakes

• Exceeding the 10 SPF lookup limit.
• Mismatch of DKIM selector during rotation.
• DMARC p=reject without prior report analysis.
• Ignoring forwarding (SPF breaks, but DKIM saves).

What's included in the work

• Audit of current DNS records and MTA configuration.
• SPF setup considering all legitimate sources (including subdomains).
• DKIM key generation and rotation, signing configuration on Postfix or Exim.
• DMARC implementation with monitoring mode followed by policy hardening.
• DMARC report monitoring for 4 weeks, delivery of a report.
• Documentation of settings and recommendations for ongoing maintenance.

If you face deliverability issues, order an audit—we'll find and fix the errors.

Stages of work

Timeline and cost

Basic configuration takes 4 to 8 hours. Full cycle with monitoring and strict policy transition takes up to 4 weeks. Cost is calculated individually based on infrastructure complexity. Basic configuration starts at $800, and full cycle with monitoring averages $2,500. The average payback period is 2–3 months due to reduced email loss. Our clients see an average 70% reduction in bounce rates.

Our engineers have 5+ years of experience in mail system configuration, Unix administration certifications, and over 50 successful projects. We guarantee that after configuration, your emails will stop landing in spam. Contact us for a consultation and we'll propose a plan.

Step-by-step configuration guide

1. Audit current DNS and mail server configuration.
2. Create or update SPF record with all sending IPs and includes, ensuring under 10 lookups.
3. Generate DKIM key pair, publish public key in DNS, configure signing on mail server.
4. Set DMARC record with p=none and aggregate report address.
5. Monitor DMARC reports for 2–4 weeks.
6. After validation, move DMARC policy to p=quarantine, then p=reject.

Our mail server setup includes configuring all DNS email records. We also provide antispam configuration and domain protection against spoofing. Proper DKIM configuration is critical for success.