Email deliverability glossary: 40 terms every sender should know
Forty email deliverability terms defined in one or two sentences each: bounces, SPF, DKIM, DMARC, spam traps, greylisting, sender reputation, inbox placement and verification.
SPF, DKIM and DMARC setup for senders: a plain-English guide
SPF, DKIM and DMARC prove your mail comes from your domain. Plain-English definitions, a comparison table, numbered setup steps with example records, and how to move DMARC from none to reject.
SPF, DKIM and DMARC are three DNS records that together prove your email really comes from your domain. SPF lists the servers allowed to send for you, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when a message fails both checks and where to send reports. Since 2024 Gmail and Yahoo require all three from anyone sending more than about 5,000 messages a day, and mail without them is increasingly filtered or rejected outright.
What do SPF, DKIM and DMARC each do?
One sentence each, the way you might explain it to a colleague:
- SPF (Sender Policy Framework) is a TXT record that lists which mail servers are permitted to send email on behalf of your domain.
- DKIM (DomainKeys Identified Mail) is a signature added to each outgoing message and verified by receivers against a public key you publish in DNS, proving the message was not altered in transit and was sent by someone holding your private key.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy record that tells receivers what to do with mail that fails SPF and DKIM alignment, and asks them to send you reports about who is sending as your domain.
SPF and DKIM are the evidence; DMARC is the rule that says what the evidence must show and what happens if it does not.
How do the three compare?
| Aspect | SPF | DKIM | DMARC |
|---|---|---|---|
| What it proves | The sending server is authorised | The message is signed and unaltered | The From domain matches the authenticated domain |
| Record type | TXT at the root of the domain | TXT at selector._domainkey.domain | TXT at _dmarc.domain |
| Checked against | The envelope sender (Return-Path) | The d= domain in the signature | The visible From header |
| Common mistake | More than 10 DNS lookups, or two SPF records | Key rotated at the sender but not in DNS | p=none forever, or jumping straight to reject |
How do you set up SPF?
- List every service that sends as your domain. Your mailbox provider, your marketing platform, your transactional sender, your CRM, your helpdesk. Most people forget one.
- Collect each service's include. Every sender documents its mechanism, for example
include:_spf.google.comfor Google Workspace orinclude:spf.protection.outlook.comfor Microsoft 365. - Publish one TXT record at the root of your domain. A typical record looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~all- Choose the ending.
~all(softfail) marks unlisted senders as suspicious;-all(fail) tells receivers to reject them. Start with~alland move to-allonce DMARC reports show nothing legitimate is missing. - Stay under the 10 lookup limit. Every
include,a,mxandredirectmechanism costs a DNS lookup, and the includes nested inside includes count too. More than 10 and receivers return a permerror, which is treated as a fail. If you are near the limit, remove services you no longer use or move some senders to a subdomain with its own record.
There must be exactly one SPF record per domain. Two records is a permerror, and it is the single most common SPF fault we see in the SPF and DMARC checker.
How do you set up DKIM?
- Generate a key pair in the sending service. Google Workspace, Microsoft 365, Brevo, Mailchimp and the rest all have a DKIM page that produces a public key and a selector name. Use 2048-bit keys where the service offers them.
- Publish the public key as a TXT record at
selector._domainkey.yourdomain.com. The shape is:
google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."Some services ask for a CNAME pointing at a record they host instead, which lets them rotate keys without you touching DNS.
- Turn signing on in the service once the record has propagated, then send yourself a message and check the headers for
dkim=pass. - Repeat for every sending service. Each one needs its own selector, which is why DKIM scales and SPF does not: selectors never collide and never count towards a lookup limit.
How do you set up DMARC?
- Publish a monitoring record first. At
_dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100p=none changes nothing about delivery; it only switches the reports on.
- Read the aggregate reports for two to four weeks. They are XML, so use a free or paid report viewer. You are looking for legitimate senders that fail, usually a tool somebody signed up for without telling you.
- Fix alignment. DMARC passes when either SPF or DKIM passes and the domain it passed for aligns with the From header. A marketing platform that signs with its own domain passes DKIM but fails alignment until you set up a custom sending domain in it.
- Move to
p=quarantine, optionally withpct=25to start, so failing mail goes to spam rather than being rejected. - Move to
p=rejectonce reports are clean. This is the point at which nobody can impersonate your domain, and it is what mailbox providers reward most.
Why do the Gmail and Yahoo rules require this?
Under the bulk sender requirements that Gmail and Yahoo introduced in 2024, anyone sending roughly 5,000 or more messages a day to their users must authenticate with SPF and DKIM, publish a DMARC record (p=none is enough to start), keep spam complaints under 0.3% with 0.1% as the target, and offer one-click unsubscribe. Mail that fails is deferred or rejected, not just filtered. Smaller senders need SPF or DKIM at minimum, but in practice the full set is the only safe configuration. We cover the rules in detail in the Gmail and Yahoo bulk sender rules.
Authentication is not the whole deliverability picture. A perfectly authenticated campaign to a list with a 4% bounce rate still gets throttled, which is why the deliverability side of Verifyre pairs these DNS checks with verification of the addresses you are sending to. Incoming mail needs the other half of your DNS to be right too; see MX records explained.
Key takeaways
- SPF authorises servers, DKIM signs messages, DMARC enforces alignment and reports on abuse.
- One SPF record only, under 10 DNS lookups, ending in ~all or -all.
- Every sending service gets its own DKIM selector; 2048-bit keys where possible.
- Start DMARC at p=none, read reports, fix alignment, then quarantine, then reject.
- Gmail and Yahoo require all three from bulk senders, alongside a complaint rate under 0.3%.
Frequently asked questions
Do I need DMARC if I already have SPF and DKIM?
Yes. Without DMARC a receiver has no instruction on what to do when a message fails, and no way to tell you someone is spoofing your domain. Gmail and Yahoo require it for bulk senders in any case.
What happens if I exceed the 10 SPF lookup limit?
Receivers return a permerror and treat SPF as failed, which means DMARC then depends entirely on DKIM. Flatten the record by removing unused services or splitting senders across subdomains.
Can I use one DKIM key for all my sending services?
Technically, if you can upload the private key to each service, but almost no service allows it. Use one selector per service; it is safer and lets you revoke one without affecting the others.
How long until the records take effect?
DNS changes propagate within the record's TTL, typically an hour. DMARC reports arrive daily, so allow at least a few days before judging the results.
