SPF, DKIM, and DMARC: The Technical Foundation for Outreach Success
If you are doing any kind of email outreach and you have not set up SPF, DKIM, and DMARC, you are leaving money on the table. These three protocols are the foundation of email authentication, and since Google and Yahoo started mandating DMARC in 2024, they are no longer optional. They are table stakes.
The good news is that while the acronyms sound intimidating, the actual setup is straightforward. Let us walk through what each one does, why it matters, and how to configure them correctly.
What Problem Are These Protocols Solving?
Email was designed in the 1970s without any built-in authentication. Anyone can send an email claiming to be from any address. You could send an email right now pretending to be from the CEO of any company, and without authentication protocols, the receiving server would have no way to verify whether you are who you claim to be.
This is obviously a problem. Phishing attacks, email spoofing, and spam all exploit this fundamental weakness. SPF, DKIM, and DMARC are three layers of authentication that work together to solve it.
For sales teams, these protocols serve a dual purpose. They protect your domain from being spoofed by bad actors, and they signal to receiving mail servers that your emails are legitimate. Both effects improve deliverability.
SPF: Sender Policy Framework
SPF is the simplest of the three. It answers one question: which servers are allowed to send email on behalf of your domain?
You create a DNS TXT record for your domain that lists every server authorized to send email from your @yourdomain.com addresses. When a receiving server gets an email from your domain, it checks this SPF record against the sending server's IP address. If the sending server is on the list, the email passes SPF. If not, it fails.
Setting It Up
Log into your DNS provider (GoDaddy, Cloudflare, Route 53, or whoever manages your domain's DNS records) and add a TXT record for your root domain. The value will look something like:
v=spf1 include:_spf.google.com include:sendgrid.net -all
This example authorizes Google Workspace and SendGrid to send on your behalf. The -all at the end means reject emails from any server not listed. If you use other sending services (Mailchimp, Outreach, Instantly), add their include statements too.
Common Mistakes
- Forgetting to include all your sending services. If you add a new email tool and do not update SPF, its emails will fail authentication.
- Using too many includes. SPF has a 10-DNS-lookup limit. Each include counts as a lookup. If you exceed 10, SPF breaks entirely.
- Using ~all (soft fail) instead of -all (hard fail). Soft fail is more lenient but also less protective. Use hard fail for better deliverability signals.
DKIM: DomainKeys Identified Mail
DKIM adds a cryptographic signature to your emails that proves the message has not been tampered with in transit. Think of it as a digital seal on an envelope.
When you send an email, your mail server attaches a DKIM signature (a hash of the email content, signed with your private key) to the message header. The receiving server looks up your public key (published in your DNS records) and uses it to verify the signature. If the signature checks out, the email is authentic and unmodified.
Setting It Up
DKIM setup varies by email provider. For Google Workspace: go to Admin Console, navigate to Apps, then Google Workspace, then Gmail, then Authenticate email. Google will generate a DKIM key and give you a DNS TXT record to publish. For other providers, check their documentation for DKIM key generation.
You will add a TXT record to your DNS with a name like google._domainkey.yourdomain.com and a value that contains your public key.
Common Mistakes
- Not setting up DKIM for all sending services. Each service that sends email on your behalf needs its own DKIM key configured.
- Using a key that is too short. Use 2048-bit keys minimum. 1024-bit keys are considered weak and some receivers will flag them.
- Not rotating keys periodically. Best practice is to rotate DKIM keys annually, though many organizations skip this without immediate consequences.
DMARC: Domain-based Message Authentication, Reporting, and Conformance
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also provides reporting so you can see who is sending email using your domain.
DMARC answers three questions: Are SPF and DKIM set up? Do they pass? And if they fail, should the receiving server reject the message, quarantine it (send to spam), or let it through anyway?
Setting It Up
Add a TXT record to your DNS with the name _dmarc.yourdomain.com and a value like:
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100
The key parameters:
- p= is the policy. Options: none (monitor only, no enforcement), quarantine (send to spam), reject (block entirely). Start with none while you are getting set up, then move to quarantine, then eventually reject.
- rua= is the reporting address. DMARC generates aggregate reports showing who is sending email from your domain and whether they pass authentication. These reports are invaluable for catching unauthorized senders.
- pct= is the percentage of messages to apply the policy to. Start at a low percentage when moving from none to quarantine so you can catch any legitimate senders you missed in your SPF record.
The Recommended Rollout Timeline
- Week 1: Set up SPF and DKIM for all sending services. Set DMARC to p=none to start collecting reports without affecting delivery.
- Weeks 2-4: Monitor DMARC reports. Identify any legitimate sending services that are failing authentication and add them to your SPF record or configure DKIM for them.
- Week 5: Move DMARC to p=quarantine with pct=10 (apply to 10 percent of messages). Monitor for any unexpected delivery issues.
- Weeks 6-8: Gradually increase pct to 100 as you confirm there are no legitimate senders being caught.
- Week 9+: Once stable at p=quarantine pct=100, consider moving to p=reject for maximum protection.
How Authentication Affects Deliverability
Proper email authentication does not guarantee inbox placement, but it removes a major obstacle. Without authentication, receiving servers treat your emails with suspicion. With full SPF, DKIM, and DMARC in place, your emails pass the first credibility test.
The effect is most pronounced for cold outreach. When you are emailing someone for the first time, the receiving server has no history with your domain. Authentication is one of the few signals it can use to determine whether your email is legitimate. Passing all three checks significantly increases your chances of landing in the inbox rather than spam.
Authentication and Data Enrichment: The Connection
This might seem like a strange topic for a data enrichment blog, but authentication and enrichment are deeply connected. The best enriched email list in the world will not generate results if your emails land in spam because you did not set up authentication.
Think of it as a two-part system. Data enrichment ensures you are emailing the right people at the right addresses. Authentication ensures those emails actually reach the inbox. Skip either part and the other part's value drops to near zero.
This is also why enrichment providers that include email verification (like BetterEnrich) are valuable beyond just finding contacts. Verified emails combined with proper authentication create the best possible deliverability outcome.
Checking Your Current Setup
Before you change anything, check what you already have configured:
- SPF: Use a tool like MXToolbox's SPF lookup to check your current SPF record. It will show you which servers are authorized and flag any errors.
- DKIM: Send a test email to a DKIM validator (several free ones exist online) to check whether your outgoing emails carry valid DKIM signatures.
- DMARC: Use a DMARC lookup tool to check whether you have a DMARC record and what policy it is set to.
If any of these are missing or misconfigured, fix them before your next outreach campaign. The setup takes less than an hour and the deliverability impact is immediate.
The Bottom Line
SPF, DKIM, and DMARC are not optional for email outreach in 2026. Google and Yahoo mandated DMARC in 2024, and other providers are following suit. Setting up all three protocols correctly takes about an hour of DNS configuration work, costs nothing, and dramatically improves your email deliverability. If you are investing in data enrichment to find the right contacts, make sure you are also investing the hour it takes to ensure your emails actually reach them.
