SPF, DKIM and DMARC for Developers Who Just Want Their Email Delivered

Description and use

Configuring SPF, DKIM, and DMARC records improves email deliverability by preventing spam, provided DNS records are correctly set and sending volume is gradually increased.

Problem

Developers send emails that return 250 OK but still land in spam because authentication records are missing or incomplete.

Outcome

After configuring SPF, DKIM, and DMARC and following best practices for warming and pacing, developers see improved inbox placement and fewer spam flags.

Workflow

• 1. Create a single SPF TXT record listing all sending services, e.g., "v=spf1 include:_spf.google.com include:amazonses.com ~all".
• 2. Ensure the SPF record uses the envelope sender (Return-Path) and stays within the 10 DNS lookup limit.
• 3. Enable DKIM at the email provider and publish the public key in DNS under the provider’s selector, e.g., "selector1._domainkey.yourdomain.com TXT \"v=DKIM1; k=rsa; p=...\"".
• 4. Publish a DMARC TXT record in monitoring mode, e.g., "_dmarc.yourdomain.com TXT \"v=DMARC1; p=none; rua=mailto:[email protected]\"".
• 5. Monitor daily XML reports for unauthorized IPs and add missing legitimate sources.
• 6. After all legitimate sources pass, change DMARC policy to quarantine, then to reject.
• 7. Warm new domains by sending small volumes to engaged users and gradually increase volume.
• 8. Pace sends throughout the day to avoid throttling and automate bounce handling with a broadcast tool.
• 9. Maintain suppression lists for hard bounces and complaints.
• 10. Verify that 250 OK responses correspond to successful inbox delivery.

Evidence

You wired up password resets or a newsletter, the SMTP call returns 250 OK, and the messages still land in spam.

Source

Three DNS records provide the proof, they take about an hour to set up, and they decide more about inbox placement than anything in your templates.

Source

SPF is a single TXT record on your root domain that lists every service allowed to send as you.

Source

DMARC passes when SPF or DKIM passes and the domain it checked aligns with the visible From domain.

Source

Sending 50,000 messages to Gmail in one burst gets throttled even with perfect records, while the same volume spread across the day goes through.

Source