Email Deliverability Guide:
SPF, DKIM, DMARC Explained

20% of legitimate business emails never reach the inbox. They're filtered to spam, blocked entirely, or silently dropped. The reason? Missing or misconfigured email authentication records: SPF, DKIM, and DMARC.

If you're sending email from a custom domain (anything@yourbusiness.com), you need all three. Without them, Gmail, Outlook, and Yahoo assume your emails might be spoofed — and they're right to be cautious. Email spoofing accounts for billions of malicious messages daily.

The Problem: Why Your Emails Go to Spam

Email was designed in 1982. The original SMTP protocol had no authentication — anyone could send email claiming to be from any address. Spam and phishing exploited this for decades. SPF, DKIM, and DMARC were added later as a layered defense:

Protocol	What It Does	Added
SPF	Lists authorized sending IPs	2006
DKIM	Cryptographic signature per email	2007
DMARC	Policy for SPF/DKIM failures	2012

As of 2024, Google and Yahoo require all bulk senders to have SPF, DKIM, and DMARC configured. No exceptions. If you send more than 5,000 emails per day, you must comply or your emails will be rejected outright.

SPF (Sender Policy Framework)

SPF is a DNS TXT record that tells the world which IP addresses are allowed to send email from your domain. Think of it as a guest list for your email server.

How SPF Works

1. Your DNS has an SPF record listing authorized IPs
2. When you send an email, the receiving server checks your DNS
3. If your server's IP is on the list → pass. If not → fail

SPF Record Example

v=spf1 ip4:178.156.211.159 include:_spf.google.com ~all

Breaking this down:

• v=spf1 — SPF version
• ip4:178.156.211.159 — Your server's IP is authorized
• include:_spf.google.com — Google's servers are also authorized (if you use Google Workspace)
• ~all — Soft fail for anything else (recommended for testing)

Use ~all (soft fail) when setting up SPF for the first time. Once you've confirmed everything works for a few weeks, switch to -all (hard fail) for maximum protection.

Common SPF Mistakes

• Too many DNS lookups — SPF has a 10-lookup limit. Each include or a mechanism counts. Use ip4 where possible.
• Multiple SPF records — You can only have ONE SPF record per domain. Merge all senders into a single record.
• Using +all — This authorizes the entire internet to send from your domain. Never do this.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send. The receiving server uses your public key (published in DNS) to verify the signature. This proves the email wasn't modified in transit and came from an authorized server.

How DKIM Works

1. Your mail server generates a private/public key pair
2. The public key is published as a DNS TXT record
3. When sending, the server signs the email with the private key
4. The receiver fetches your public key from DNS and verifies the signature

DKIM DNS Record Example

default._domainkey.yourdomain.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."

The default part is the selector — you can have multiple DKIM keys for different sending services. The p= value is your base64-encoded public key.

How to Set Up DKIM

• cPanel/WHM — Enabled by default in Exim. Check in WHM → Email → DKIM
• Google Workspace — Admin Console → Apps → Gmail → Authenticate email
• Microsoft 365 — Exchange admin center → Protection → DKIM
• TyTe Hosting — DKIM is automatically configured on all email accounts. Contact support if you need help verifying.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC is the policy layer. It tells receiving servers what to do when SPF and/or DKIM fail. Without DMARC, failed authentication is silently ignored. With DMARC, you control the outcome.

DMARC Record Example

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100;"

Breaking this down:

• p=quarantine — Failed emails go to spam (recommended starting point)
• p=reject — Failed emails are rejected entirely (maximum protection)
• p=none — Monitor only, no action taken (for testing)
• rua=mailto:... — Where to send daily aggregate reports
• pct=100 — Apply policy to 100% of emails

The DMARC Rollout Strategy

1. Week 1-2: p=none — Monitor only. Collect reports, see what's failing.
2. Week 3-4: p=quarantine; pct=25 — Quarantine 25% of failures.
3. Week 5-6: p=quarantine; pct=100 — Quarantine all failures.
4. Week 7+: p=reject; pct=100 — Reject all failures. Full protection.

DMARC reports are XML files sent daily to your rua address. Use a free tool like dmarcian or Postmark's DMARC analyzer to parse them.

Additional Deliverability Factors

Reverse DNS (PTR Record)

Your mail server's IP must have a reverse DNS record that matches its hostname. If your server says mail.yourdomain.com but the PTR resolves to something else, many providers will reject your email.

Email Content Best Practices

• Don't use spam trigger words: "FREE", "GUARANTEE", "CLICK HERE", "ACT NOW"
• Keep image-to-text ratio reasonable (60% text minimum)
• Always include a plain-text version of HTML emails
• Use a real reply-to address, not noreply@
• Include an unsubscribe link (required by law for marketing emails)

Sender Reputation

Your domain and IP have reputation scores with Gmail, Outlook, and Yahoo. Factors include:

• Spam complaint rate (target: under 0.1%)
• Bounce rate (target: under 2%)
• Volume consistency (sudden spikes look suspicious)
• Engagement (opens, clicks, replies)

TyTe Hosting Email: Authentication Included

Every TyTe Hosting email account comes with SPF, DKIM, and DMARC pre-configured. We also provide:

• 50 mailboxes for $69.99/month (vs Google Workspace's $300/month for the same)
• Full IMAP/POP3 access
• Webmail at mail.yourdomain.com
• Spam filtering with SpamAssassin
• Automatic TLS on all connections

Ready to switch? See our Business Email Hosting page or check city-specific pages like business email in Orlando.