Three short acronyms decide whether inbox providers trust your email: SPF, DKIM, and DMARC. Together they're called email authentication. They sound technical, but each does one simple job, and you can set all three up in a single sitting.

What is SPF?

SPF (Sender Policy Framework) is a short list, stored in your domain settings, of the servers allowed to send email using your domain name. Think of it as the guest list at the door.

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your sending server signs it with a private key, and your domain publishes the matching public key, so providers can confirm the message wasn't altered.

What is DMARC?

DMARC ties SPF and DKIM together. It tells providers what to do when checks fail (let the message through, quarantine it, or reject it) and can send you reports.

How to set up SPF, DKIM, and DMARC

  1. Choose your sending provider, such as Amazon SES, SendGrid, or Mailgun, and add your domain there.
  2. Copy the SPF and DKIM DNS records your provider gives you, exactly as shown.
  3. Add each record where your domain's DNS is managed.
  4. Wait for the records to take effect, which can take minutes to several hours, then click verify in your provider's dashboard.
  5. Add a DMARC record. Most people start with a monitoring-only policy, then tighten it once the reports look clean.
  6. Send a test email to yourself and check the message headers for SPF, DKIM, and DMARC passes.

Common mistakes to avoid

  • Typos when copying a record
  • Publishing two SPF records instead of one combined record
  • Forgetting to verify the domain in your provider's dashboard

Next steps

Once your records pass, you're ready to send. Zaap Mail works with Amazon SES, SendGrid, Mailgun, SparkPost, ElasticEmail, or your own SMTP server.