Email deliverability basics: SPF, DKIM and DMARC in plain English

You can write the best email of your life and it won't matter if it lands in spam. Deliverability — whether your email reaches the inbox — depends heavily on a few technical settings most businesses set up once and never look at again.

Why email authentication matters

Email was designed without a way to prove who sent a message, which is why spoofing and phishing are so common. Mailbox providers now rely on three DNS-based standards to decide whether a message really comes from your domain: SPF, DKIM and DMARC.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email for your domain. If you send through a provider such as Amazon SES, SendGrid or Mailgun, their servers need to be included.

example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

DKIM: proof the message wasn't changed

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email. The public key is published in your DNS; receiving servers use it to check the signature. A valid DKIM signature shows the message came from an authorised sender and wasn't altered on the way.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM to the domain in your visible “From” address, and tells receivers what to do with messages that fail: nothing (p=none), send to spam (p=quarantine) or reject (p=reject). It also lets you receive reports about who is sending email using your domain.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Start with p=none to collect reports, fix any legitimate senders that fail, then move to quarantine and eventually reject.

Gmail and Yahoo bulk sender requirements

Since 2024, Gmail and Yahoo require bulk senders (Google defines this as close to 5,000 or more messages a day to Gmail addresses) to:

• Authenticate with SPF and DKIM, and publish a DMARC record.
• Support one-click unsubscribe (RFC 8058) for marketing email and honour unsubscribes promptly.
• Keep spam complaint rates low — Google asks senders to stay below 0.3%, and ideally well under 0.1%.

Even if you send less, following these rules improves inbox placement everywhere.

List hygiene: the part people skip

1. Use double opt-in for signup forms so only real, interested addresses join.
2. Verify imported lists before sending — invalid addresses cause bounces that hurt your reputation.
3. Remove hard bounces immediately and stop mailing people who haven't engaged in a long time.
4. Warm up new domains and IPs by increasing volume gradually rather than sending a large campaign on day one.

Tools that help

LEBX Mail guides you through SPF, DKIM and DMARC records, supports IP warmup schedules, integrates list verification providers, handles bounces and adds one-click unsubscribe headers. To check your DNS records yourself, the TXT and CNAME lookup tools on ToolsLeb are free.

If you want the whole setup done for you — domains, templates, automations and tracking — that's part of our growth infrastructure work.