How to configure SPF, DKIM, and DMARC for maximum email deliverability

What Are Email Authentication Records?

When you send an email from your custom domain (e.g. hello@yourstartup.com), email providers like Gmail or Outlook need to verify that you are actually the owner of that domain and not an attacker trying to spoof your identity.

Without correct authentication, your emails will either land directly in the spam folder or be rejected completely. There are three key DNS records you must configure:

---

1. SPF (Sender Policy Framework)

SPF is a TXT record added to your DNS settings that lists all the IP addresses and servers authorized to send emails on behalf of your domain.

• Example SPF Record for Senviok (AWS SES):
  • Type: TXT
  • Host: @ (or blank)
  • Value: v=spf1 include:amazonses.com ~all

---

2. DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email header. Receiving servers use your public DNS key to decrypt the signature and verify that the email was not modified in transit.

Senviok uses Easy DKIM, providing you with 3 CNAME records to add. Once added, AWS SES automatically handles key rotation and signing.

---

3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together. It tells mail servers exactly what to do if an email fails SPF or DKIM checks (e.g. do nothing, quarantine to spam, or reject entirely).

• Recommended DMARC Policy for Startups:
  • Type: TXT
  • Host: _dmarc
  • Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Adding these records takes less than 10 minutes but permanently secures your domain reputation and maximizes inbox placement.