Envíos Masivos Panamá.
ESENPTFRIT
Free Law 81 check

SPF, DKIM and DMARC: how to authenticate your domain so your email doesn't land in spam

The number-one technical cause of your emails landing in spam — or not arriving at all — is authentication. What SPF, DKIM and DMARC are in plain terms, the alignment trap, and how to turn them on without blocking your own mail.

June 29, 2026 6 min read Envíos Masivos Panamá

Your email says “sent” but the customer swears it never arrived. Before you check the copy or the list, check the following: the number-one technical cause of an email landing in spam — or not even getting in — is domain authentication. And since 2024 it stopped being optional. This guide explains in plain terms what SPF, DKIM and DMARC are, why all three together matter, and how to turn them on without blocking yourself.

The good news: they’re records you configure just once in your domain’s DNS. It isn’t day-to-day work; it’s setting them up right and keeping them.

What happens if you don’t have them (the 2026 reality)

Gmail and Yahoo made authentication mandatory in February 2024 for anyone sending at volume; Microsoft (Outlook, Hotmail, Live) joined in May 2025. And it’s no longer just “we send you to spam”: since November 2025 Gmail rejects unauthenticated mail at the server level — it doesn’t even reach the spam folder, it bounces.

A “bulk sender” is anyone who sends 5,000 or more emails a day to a single provider (personal Gmail addresses, for example). And a key detail: if you cross that threshold once, you’re permanently classified as a bulk sender, even if you later lower the volume. The recommendation from all three providers is clear: anyone who sends seriously should have all three, regardless of size.

SPF: who can send in your name

SPF (Sender Policy Framework) is a list, published in your DNS, of the servers authorised to send mail using your domain. When an email arrives, the provider looks at which server it came from and compares it with your list. If the IP isn’t there, it raises suspicion.

In practice it’s a TXT record at the root of your domain that includes your sending provider. Three things almost nobody looks after:

  • The 10 DNS-lookup limit. An SPF record can only trigger 10 lookups. If you chain many tools (your email platform, the CRM, billing, Google Workspace…), you go over, SPF returns PermError and fails completely. You have to audit and consolidate it.
  • ~all before -all. The end of the record defines how strict you are. Start with ~all (soft fail) and harden to -all (reject) only after confirming all your legitimate mail passes. Hardening too early blocks your own sends.
  • SPF breaks on forwarding. If someone forwards your email, the forwarder’s IP isn’t on your list and SPF fails. That’s why SPF alone isn’t enough: you need DKIM.

DKIM: the seal that proves the mail is yours

DKIM (DomainKeys Identified Mail) puts a cryptographic signature on each message. Your sending provider keeps the private key; the public one lives in your DNS. The receiver verifies the signature and confirms two things: that the email really came from your domain and that no one altered it along the way.

What matters, in plain terms:

  • Use a 2048-bit key (the high option). Yahoo rejects old 512-bit keys even if everything else is right.
  • Unlike SPF, DKIM survives forwarding. That’s why it’s the pillar of modern authentication.
  • It’s good to rotate the key once a year; most providers automate this.

DMARC: the rule that ties it all together (and warns you)

DMARC is the instruction that tells the provider what to do when an email claims to be yours but fails SPF and DKIM. It has three policy levels:

  • p=none — observe only. Blocks nothing; sends you reports. It’s the starting point.
  • p=quarantine — sends what fails to the spam folder.
  • p=reject — rejects the mail that fails. Maximum protection against spoofing.

DMARC also sends you reports (the rua tag): a daily summary of who is sending — or spoofing — with your domain. It’s gold: you discover legitimate services you forgot to authorise and, along the way, the impostors.

p=none puts you “in order” to start, but the providers have already warned it’s only the first phase: staying there forever is a poor trust signal. The goal for a serious brand in 2026 is to move at least to p=quarantine.

The trap that breaks almost every setup: alignment

This is where most people fall. It’s not enough for SPF or DKIM to “pass”: the domain the customer sees in the From: field has to match (align with) the domain that validated SPF or DKIM. An SPF that technically passes but doesn’t align with your From: still makes DMARC fail.

It’s the most common mistake when you use several platforms: the mail goes out “well signed”, but under another domain, and DMARC flags it as suspicious. If you see errors like 421-4.7.32 (Gmail) or 550 5.7.515 (Microsoft), it’s almost always alignment.

How to roll it out without blocking your own mail

Order matters, because doing it wrong leaves you unable to send:

  1. SPF at the root, including your sending provider, ending in ~all and under 10 DNS lookups.
  2. DKIM with a 2048-bit key, publishing in your DNS the record your provider gives you.
  3. DMARC at _dmarc.yourdomain, starting at p=none with rua pointing to a mailbox you check. Something like: v=DMARC1; p=none; rua=mailto:[email protected]; aspf=r; adkim=r.
  4. Watch the reports for one to four weeks. When you confirm all your legitimate mail passes and aligns, move up to p=quarantine and, later, to p=reject (and harden SPF to -all).

A frequent oversight: the DMARC for yourdomain.com doesn’t cover subdomains. If you send from mail.yourdomain.com, that subdomain needs its own record.

Don’t forget one-click unsubscribe

Alongside authentication, providers require one-click unsubscribe for bulk mail. And note: it’s not the “unsubscribe” link at the foot of the email. It’s a pair of technical headers (List-Unsubscribe and List-Unsubscribe-Post, per RFC 8058) that let Gmail show an “Unsubscribe” button above the message. It’s, in fact, the requirement most senders fail. Making it easy for those who want to leave reduces spam complaints — and, in Panama, helps you respect the right of opposition required by Law 81.

How do I know it’s right

Don’t guess: measure it. Register your domain in Google Postmaster Tools (and in the Yahoo and Microsoft panels) to see your authentication and your complaint rate as they see it. There are free SPF, DKIM and DMARC checkers for a quick snapshot. And remember the number that governs it all: your complaint rate must stay below 0.3% — ideally near 0.1%.

The full picture of what deliverability is, the Gmail and Yahoo rules and reputation is in our guide to email deliverability.

In Panama: how we solve it

Setting up SPF, DKIM and DMARC right — aligned, without going over the 10 lookups, with the policy ramping up in phases and the reports watched — is exactly the kind of technical detail that sinks campaigns when it’s done halfway. In our deliverability service we leave it set up and monitored for you: aligned authentication, one-click unsubscribe, a cared-for reputation and the DMARC policy advancing as far as your mail can take without blocking.

Not sure what state your domain is in today? Start with the free check: we tell you whether your authentication passes, where it aligns badly and what to fix first.