Deliverability is whether your email actually reaches the inbox instead of the spam folder or nowhere at all. You can write a great message and still lose it because mailbox providers do not trust where it came from. Three DNS records, SPF, DKIM and DMARC, are the foundation of that trust.
You do not need to be an engineer to understand them. This guide explains each in plain English, covers sender reputation and list hygiene, and ends with a checklist to run before you send. DNS changes should be made carefully, so involve whoever manages your domain.
SPF: who is allowed to send for your domain
SPF stands for Sender Policy Framework. It is a DNS record that lists the services allowed to send email using your domain, such as your email host and your marketing platform. When a message arrives, the receiving server checks whether the sending server is on that list.
A domain should have only one SPF record. If you use several services, they are combined into that single record. Adding a second SPF record instead of editing the existing one is a classic mistake that can make SPF fail for everyone.
DKIM: a signature that proves the message is intact
DKIM stands for DomainKeys Identified Mail. Your sending service adds a digital signature to each message, and a public key in your DNS lets receivers verify it. If the signature checks out, the message really came from an authorized sender and was not altered on the way.
Each sending service usually gives you its own DKIM record to publish. Because it is a separate record for each service, you can add DKIM for a new platform without touching the ones already working.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM together. It tells receivers what to do if a message fails authentication and where to send reports about it. The policy can be set to monitor only, quarantine or reject. Many organizations start in monitor mode, read the reports to find legitimate senders they forgot, and tighten the policy gradually.
DMARC also checks alignment, meaning the domain in the visible From address should match the domain that passed SPF or DKIM. This is why sending marketing email "from" your domain through a third-party tool requires setting up that tool correctly.
Set up a sending domain without breaking company email
This is where small businesses get hurt. Your regular mailboxes already depend on existing DNS records. A careless change can stop staff email from sending or arriving. Follow these rules:
- Export or screenshot every current DNS record before you change anything.
- Edit the existing SPF record to add the new service. Never create a second SPF record.
- Add the new DKIM records as additional entries. They do not replace existing ones.
- Start DMARC in monitor mode, and only tighten it after reviewing reports.
- Consider using a subdomain, such as a dedicated mail subdomain, for marketing sends so their reputation stays separate from daily company email.
- Send test messages from both the marketing tool and a normal mailbox afterward, and confirm both arrive.
Document what you did and why, including the date and the person who made each change. When someone adds another sending tool a year from now, that record prevents the quiet breakage that causes so many missing-email mysteries.
If you manage a website and domain together, our web development team can handle DNS changes with a rollback plan.
Sender rules, reputation and list hygiene
Google and Yahoo have published requirements for senders, with stricter ones for bulk senders, generally those sending thousands of messages a day to their users. The published expectations include authenticating with SPF and DKIM, publishing a DMARC policy, easy unsubscribing (including one-click unsubscribe for marketing mail), and keeping spam complaint rates low. Because details and thresholds are updated, confirm current requirements in the official Google and Yahoo sender guidelines. This is not legal or compliance advice.
Sender reputation is the track record mailbox providers build for your domain and sending address. It improves when people open, click and reply, and suffers when they complain, bounce or ignore. Protect it with list hygiene:
- Only email people who asked to hear from you.
- Remove hard bounces immediately.
- Honor unsubscribe requests promptly.
- Suppress subscribers who have not engaged for a long period, or run a re-permission email before deleting them.
- Avoid sudden jumps in volume, especially from a new domain.
A pre-send checklist
Run through these before a campaign goes out:
- SPF, DKIM and DMARC all pass on a test message. Most email tools show the authentication results in the message headers.
- The From name and reply address are real and monitored.
- The footer includes your physical postal address and a working unsubscribe link, as CAN-SPAM requires. Confirm current rules with the FTC or an attorney.
- Links go to the correct pages and are tagged with UTMs so GA4 can report on them.
- The list is current, with bounces and unsubscribes removed.
- The message reads well on a phone and has a sensible text-to-image balance.
For help tying campaigns back to results, see our digital marketing services.
Key takeaways
- SPF lists approved senders, DKIM signs messages and DMARC sets the failure policy.
- Edit your existing SPF record. Never publish two.
- Back up current DNS records and test normal company email after every change.
- Keep complaints and bounces low with clean, permission-based lists.
- Confirm current Google, Yahoo and CAN-SPAM requirements before large sends.