Setting up SPF, DKIM and DMARC for an Email Domain

Setting up SPF, DKIM and DMARC for an Email Domain

Imagine you set up a mailing campaign, but 90% of your emails never reach the inbox — spam folders, blocks, blacklists. Without SPF, DKIM, and DMARC, your domain is an open target for phishers, and deliverability plummets. With Google and Yahoo now requiring these checks for senders with volumes over 5,000 emails per day, configuring these records is mandatory.

Recently, a client sending 10,000 emails per day faced an SPF PermError due to 14 DNS lookups. After SPF Flattening, deliverability jumped from 45% to 98% — a 2.2x increase. We help configure email domain protection end-to-end, ensuring your emails are guaranteed to be delivered. With experience on over 50 projects configuring mail infrastructure for high-traffic domains, results are assured.

According to statistics, 60% of all deliverability issues are caused by incorrect SPF and DKIM configuration. Meanwhile, 80% of companies do not use DMARC, leaving their domains unprotected. Our solution includes a full audit and phased implementation, reducing the risk of legitimate email blocking by 95% and cutting processing time at providers.

SPF — Sender Policy Framework

An SPF record lists the servers authorized to send emails on behalf of your domain. It is checked against the sending server's IP.

DNS TXT record for example.com:

v=spf1 include:sendgrid.net include:amazonses.com ip4:203.0.113.10 ~all 

Syntax of mechanisms:

SPF Flattening — a solution for exceeding the DNS lookup limit. It replaces include: with concrete IP addresses, reducing the number of lookups by up to 40% compared to the original list. SPF Flattening can be done manually or via services like AutoSPF.

How to Perform SPF Flattening Manually (Step-by-Step)

1. Obtain the IP address list from each ESP (SendGrid, Mailgun, etc.) via their API or documentation.
2. Combine all IP addresses into a single SPF record using ip4 and ip6 mechanisms.
3. Ensure the total number of DNS lookups does not exceed 10 (use an SPF calculator).
4. Add ~all or -all at the end of the record.
5. Update the DNS record and wait for propagation (usually up to 15 minutes).

DKIM — DomainKeys Identified Mail

DKIM adds a digital signature to every email. The recipient verifies the signature using a public key in DNS.

Generating a key pair (for your own SMTP/Postfix):

openssl genrsa -out dkim_private.pem 2048 openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem 

DNS TXT record:

default._domainkey.example.com TXT "v=DKIM1; k=rsa; p=<base64-public-key>" 

For ESPs (Resend, SendGrid, Mailgun) — they generate the key pair and provide ready-made DNS records via their dashboard. Make sure to use the correct selector (usually default or s1).

DMARC — Domain-based Message Authentication

DMARC defines a policy for emails that fail SPF/DKIM:

_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100; adkim=r; aspf=r" # Implementation strategy: # Step 1 — monitoring with p=none # Step 2 — after 2-4 weeks p=quarantine; pct=10 # Step 3 — final p=reject; pct=100 

DMARC (per RFC 7489) not only protects against phishing but also improves domain reputation. With p=reject, spam is rejected at the SMTP level, and Gmail and Yahoo consider DMARC policy when filtering.

Why DMARC Matters for Deliverability

DMARC not only protects against phishing but also enhances domain reputation. When set to p=reject, spam is rejected early in the SMTP handshake, and Gmail and Yahoo factor DMARC policy into their filtering decisions. Without it, even legitimate emails may land in spam due to partial SPF/DKIM alignment.

Comparison of DMARC Policies

DMARC with p=reject blocks up to 99% of phishing attacks, while p=none allows more than half to pass.

How to Avoid SPF PermError

PermError occurs when the 10 DNS lookup limit is exceeded. To avoid it:

• Use SPF Flattening — replace include: with concrete IP addresses from services (SendGrid, Mailgun).
• Leverage third-party tools like AutoSPF or EasyDMARC for automatic compaction.
• Minimize the number of include: statements — consolidate multiple records from the same provider.

BIMI — Brand Indicators for Message Identification

Display your logo in Gmail/Apple Mail inboxes — an additional step after DMARC p=quarantine or p=reject:

default._bimi.example.com TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/bimi.pem" 

The logo must be in SVG Tiny 1.2 format. Apple Mail requires a VMC certificate from DigiCert/Entrust.

Verification of Settings

1. Send a test email to mail-tester.com and review your score.
2. Use MXToolbox (SPF, DKIM, DMARC checks).
3. Set up DMARC report monitoring via Valimail or Dmarcian.

Google Postmaster Tools help track your domain reputation in Gmail.

Common Issues

SPF PermError (too many DNS lookups): Apply SPF Flattening — replace include: with concrete IP addresses via third-party services.

DKIM verify failed: Ensure the ESP is configured to sign with the correct selector and that CNAME records are added to DNS.

DMARC not working: SPF and DKIM must pass alignment — the domain in the From: header must match the envelope-from domain (for SPF) or the d= domain in the DKIM signature.

What's Included in the Setup (Deliverables)

• Audit of current DNS records and mail infrastructure
• Generation and addition of SPF, DKIM, DMARC records
• Configuration of monitoring via DMARC analytics and Postmaster Tools
• Gradual policy rollout with report oversight
• Documentation of all changes and staff training
• Two weeks of post-completion support

Timeline

Typically, setting up SPF + DKIM + DMARC takes 1 to 2 days. With monitoring and a phased transition to p=reject, it can take up to 2 weeks. The cost is calculated individually.

Over 5 years of experience and more than 50 projects configuring mail infrastructure for high-traffic domains. Order an audit of your current settings — contact us for a consultation. Get a consultation on configuring your domain.