Unconfigured technical records are a major threat to your domain: they open the door to phishing, lower your sender score, and guarantee worse deliverability.

In this guide, we'll explain what SPF, DKIM, and DMARC are and how they work together to protect your domain and sender reputation.

What is email authentication?

Authentication is a set of rules that let the recipient's mail server confirm your identity as the sender.

The process consists of three key stages, implemented through special TXT records in your domain's DNS:

  • SPF (Sender Policy Framework) — a list of trusted couriers

This is a text record in your domain settings (DNS) that lists every IP address and service allowed to send mail on your behalf. When you send an email through your email service provider (ESP), the recipient's server (say, Gmail) asks your domain: "Is this IP address (this courier) allowed to deliver mail on your behalf?"

Setup: you tell your domain, "I authorize SendPulse, Letteros, and my CRM to send emails on my behalf."The point: if a scammer tries to send an email pretending to be you from some random computer not on the list, SPF blocks it.

  • DKIM (DomainKeys Identified Mail) is like an invisible but unique digital seal on the envelope.

It's an authentication method that uses a cryptographic signature to confirm that an email wasn't altered during delivery. When your email leaves your sending service, it gets stamped with a unique digital signature. If anyone tampers with the text, a link, or an image along the way, the seal breaks.

Setup: your email service provider (ESP) generates a unique signing key, and you publish the second half of it in your DNS.The point: the recipient's server checks whether the signature on the email matches the key in your domain. If it matches, the email is intact and hasn't been tampered with.

  • DMARC is the head instructor and overseer.

It ties SPF and DKIM together and answers two key questions:

  • What should happen if an email fails the check (a broken seal, or the wrong courier)?
  • Who tried to send emails pretending to be me, and from where?

Setup: you publish your policy in DNS (for example, "just monitor" or "reject all bad emails").The point: DMARC gives you reports showing every spoofing attempt and lets you defend yourself by telling mail providers what to do with suspicious emails — send them to spam or reject them entirely.

A simple guide to setting up SPF, DKIM, and DMARC

The process consists of three main steps.

Step 1: Set up SPF (the list of authorized couriers)

Goal: tell every mail provider which services are authorized to send email on behalf of your domain.

Action

What to do

Why it matters

1. Compile the list

Identify every service that uses your domain to send email — your main ESP, CRM, transactional email service.

If you forget a service, its emails will land in spam.

2. Get the code

Each service (Letteros, for instance) gives you a short code to add to your SPF record. It usually looks like this: include:spffilter.letteros.com.

That's your "trusted courier."

3. Combine and publish

You create a single TXT record in your domain's DNS. It should start with v=spf1, include all your codes, and end with ~all (a soft policy).

A domain can only have one SPF record. Example: v=spf1 include:esp1.com include:esp2.com ~all

Step 2: Set up DKIM (the digital seal)

Goal: give your emails a digital signature to guarantee integrity.

Action

What to do

Why it matters

1. Generate the keys

Go to your main ESP's settings (Letteros, for example). Click "Generate DKIM key."

The service will give you a long code that needs to be published.

2. Create the record

The ESP will give you two values: the record's Name (often default._domainkey) and its Value — the long key itself.

Add both values to your DNS as a TXT record.

3. Activate it

Go back to your ESP and click "Verify" or "Activate." If you did everything correctly, the service will confirm it can see your signature.

You now have an official "digital seal" for your emails.

Step 3: Set up DMARC (policy and reports)

Goal: tell mail providers what to do with "bad" emails, and receive reports on spoofing attempts.

Action

What to do

Why it matters

1. Create an initial record

Create another TXT record in your DNS.

The record is always named _dmarc.

2. Set up "monitoring"

Start with the softest policy: v=DMARC1; p=none; rua=mailto:your@email.com

p=none means you're just monitoring the situation without blocking any emails.

3. Specify a reporting address

The rua=mailto:your@email.com part is the address where mail providers will send you daily reports (they arrive in XML format).

You'll be able to see who's trying to spoof your domain.

4. Tighten the policy gradually

After 2–4 weeks of analyzing reports and confirming that all your legitimate emails pass the check, change p=none to p=quarantine (suspicious emails go to Spam) or p=reject (they're rejected outright).

This gives you maximum protection against phishing.

Bottom line: why does a marketer need this?

All three records exist so that your domain maintains a high trust rating (Sender Score).

If you don't set up this system, mail providers will treat you as suspicious. As a result:

  • Your emails end up in Spam.
  • Your Open Rate drops to near zero.
  • Scammers can easily impersonate your brand.

Setting up SPF, DKIM, and DMARC is the fastest way to improve deliverability.

Build your emails in Letteros, and we'll take care of the technical side

Setting up your domain is the foundation. For newsletters to work reliably and make money, the build process needs to be simple and predictable.Why give Letteros a try:

  • Deliverability control: the system checks your SPF and DKIM for you. If something's set up wrong, you'll find out before sending — not after your reach tanks.
  • No-code building: in the block editor, you can put together an email in 15 minutes — faster than writing a brief for a designer or wrestling with HTML.
  • Auto-adaptation: you don't need to check how the email looks on an iPhone or in dark mode. We've already set up the blocks to display correctly everywhere.
Попробовать Letteros бесплатно

Sources: