Marketing
Email Deliverability: SPF, DKIM and DMARC Basics
Understand SPF, DKIM and DMARC, then use an original sender-readiness register to separate authentication, permission and inbox placement.
What you will learn
- Explain the different roles of SPF, DKIM and DMARC.
- Separate authentication evidence from permission and deliverability.
- Prepare a safe diagnostic handoff to the DNS or sending owner.
Email deliverability is not one setting. SPF, DKIM and DMARC help receiving systems evaluate sender authentication, but they do not guarantee inbox placement or permission to contact someone. Check authentication, recipient expectations, sending behavior and provider feedback as separate parts of the problem.
What SPF, DKIM and DMARC each do
Google's sender guidelines explain authentication requirements for mail sent to personal Gmail accounts, with additional requirements for higher-volume senders. Read the current rules for your provider and sending situation before making configuration changes.
| Mechanism | Basic role | What it does not prove |
|---|---|---|
| SPF | A domain publishes which sending systems are authorized for its SPF identity | That the recipient requested the message or that it belongs in the inbox |
| DKIM | A cryptographic signature lets a receiver verify the signing domain and message integrity for signed content | That every claim or link in the message is trustworthy |
| DMARC | Connects authentication to alignment with the visible From domain and publishes handling/reporting policy | That an aggressive policy can safely be deployed without reviewing legitimate senders |
DMARC can pass through an aligned SPF result or an aligned DKIM result. Keep these technical checks separate from consent and from the receiver's final delivery decision. Ask the sending owner to verify alignment against current provider requirements before any configuration change.
A fictional sender-readiness register
| Area | Evidence to request | Fictional finding and next owner |
|---|---|---|
| Sending inventory | List of legitimate tools and domains that send mail | Billing and marketing tools identified; support tool unresolved |
| Authentication | Approved test headers or provider diagnostics | DKIM result recorded for one tool; other sending paths still untested |
| Alignment | Visible From domain and authenticated domains | DNS/sending owner must confirm the intended alignment |
| Permission | How and when the recipient asked to hear from the sender | Requested resource delivery is known; optional marketing permission is unresolved |
| Recipient feedback | Bounces, complaints, deferrals and provider reports | Review actual reason codes before changing volume or content |
A passing test for one provider does not confirm every sending path. Keep the scope of the evidence visible. A screenshot saying “verified” without a domain, sender and date is not enough for a reliable handoff.
Copyable AI prompt
Try this with Aurora AI in Finta, Codex, or Claude. Use only material you are authorized to share, and review the draft before using it.
Prepare a sender-readiness review using [authorized provider diagnostics], [sending inventory], [redacted test headers] and [permission records]. Separate SPF, DKIM, DMARC alignment, permission and delivery symptoms. Return evidence, scope/date, unknowns and questions for the DNS/sending owner. Do not expose credentials, invent compliance conclusions, propose unreviewed DNS changes or send test campaigns. Draft a human-review handoff only.Diagnose the symptom before changing DNS
Separate a rejection, a temporary deferral, an accepted message and a message delivered to spam. Record the provider response and affected sending path. Missing open tracking does not prove non-delivery; some recipients block images or use privacy features.
Ask the responsible administrator to review legitimate senders before changing SPF, rotating DKIM or increasing DMARC enforcement. A wrong change can disrupt valid mail. This guide is preparation, not an instruction to paste a generic DNS record into production.
Permission matters independently. Mailchimp's permission guidance explains its requirements for marketing audiences. Use the rules that apply to your actual provider, audience and jurisdiction rather than treating authentication as legal compliance.
Keep follow-through relevant
Send what the recipient expects, maintain working unsubscribe and suppression processes, and investigate problems before increasing volume. Do not treat a new domain or additional inboxes as a substitute for a useful, permissioned message.
For the relationship side, use the warm introduction playbook and the marketing strategy guide. Finta's agent directory can help you explore a relevant preparation task, but an AI draft does not configure authentication, create recipient permission or guarantee delivery.