SPF, DKIM and DMARC for founders, so your launch emails land

SPF, DKIM and DMARC are DNS records that prove email from your domain really comes from you. SPF lists the servers allowed to send your mail, DKIM signs each message so receivers can check it wasn't altered, and DMARC tells receivers what to do when those checks fail. Since February 2024, Gmail and Yahoo have required all three from bulk senders, and Outlook.com followed in May 2025, so a launch without them risks landing in spam.

Why do launch emails go to spam?

A launch is often the first time a new product sends email in volume: a waitlist announcement, a burst of sign-up confirmations, receipts and password resets. Mail providers see a domain they barely know suddenly sending hundreds or thousands of messages. Their first question is whether that mail is really from you.

If the domain can't prove it, the safest move for the receiver is the spam folder, or a rejection. Missing authentication is the most common reason for this, and the easiest to fix. Other reasons matter too: a brand-new domain with no sending history, a list of people who never asked to hear from you, or content that looks like spam. Authentication doesn't fix those, but without it the rest hardly matters.

What does SPF do?

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send mail for it. When a message arrives, the receiver checks whether the server that sent it is on your list.

A few rules trip people up:

• One SPF record per domain. If you add a second one for a new email service, both can fail. Merge them into one record with several include: entries instead.
• A 10-lookup limit. The SPF standard caps the DNS lookups a check may need at 10. Every include: for another service uses at least one, so a domain that sends through many tools can quietly go over the limit and fail.
• How it ends matters. A record ending in -all tells receivers to fail mail from anywhere else; ~all asks them to treat it as suspicious. Start with ~all while you confirm every sender is listed.

SPF checks the domain in the message's hidden return address, not the From address people see. That gap is why DMARC exists.

What does DKIM do?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. Your email provider signs outgoing mail with a private key, and you publish the matching public key in DNS, under a name called a selector (something like s1._domainkey.yourdomain.com). The receiver fetches the key and checks the signature. If it matches, the message really came through a server you authorized and wasn't changed on the way.

In practice you rarely build this yourself. Your email provider, whether that's Google Workspace, Microsoft 365 or a sending service for product email, gives you one or more DNS records to add. Add them for every service that sends as your domain, including the newsletter tool and the one that sends receipts.

What does DMARC do, and where should you start?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It does two things.

First, it ties SPF and DKIM to the From address people actually see. DMARC passes only when SPF or DKIM passes for a domain that matches the From domain. This is called alignment, and it's what stops someone sending mail that merely claims to be from you.

Second, it sets a policy for mail that fails:

• p=none: deliver it as usual, but send me reports.
• p=quarantine: treat it as suspicious, usually the spam folder.
• p=reject: refuse it.

Start with p=none and a reporting address (the rua= tag). The reports show every service sending mail as your domain, including ones you forgot about. Once every legitimate sender passes, move to quarantine and later reject. Jumping straight to reject before you know who sends as you is a reliable way to lose your own receipts.

What do Gmail, Yahoo and Outlook require?

Google announced in October 2023 that, starting in February 2024, anyone sending more than 5,000 messages a day to Gmail addresses would have to meet new rules, and Yahoo announced similar requirements at the same time. For those bulk senders, the rules are:

• SPF and DKIM both set up for the sending domain.
• A DMARC record, with a policy of at least p=none.
• The From domain aligned with SPF or DKIM.
• One-click unsubscribe on marketing and subscribed mail, with requests honored within two days. Transactional mail, such as receipts and password resets, doesn't need it.
• A low spam-complaint rate. Google's guidelines ask senders to stay below 0.1% as reported in its Postmaster Tools and never reach 0.3%.

Google also asks every sender, whatever the volume, to set up at least SPF or DKIM. Microsoft applied similar rules to domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses, enforced from May 5, 2025: SPF, DKIM and DMARC at least at p=none, aligned with SPF or DKIM.

You may not hit 5,000 a day at launch. Set up all three anyway: it costs nothing, the providers recommend it for everyone, and you'll be ready if the launch goes well.

What is BIMI, and do you need it?

BIMI (Brand Indicators for Message Identification) lets supporting inboxes show your logo next to your messages. It's a nice touch, not a requirement. It only works once DMARC is at enforcement (quarantine or reject), and Gmail also requires a paid certificate for the logo (a Verified Mark Certificate or Common Mark Certificate). Get SPF, DKIM and DMARC right first; BIMI can wait.

Does a new domain hurt deliverability?

It can. Many spam filters treat mail from a domain registered very recently with extra caution, because spammers often use fresh domains. If you bought your domain shortly before launch, send gradually at first: start with the people most likely to open your mail, such as your waitlist, rather than a large cold list.

Some founders also send marketing email from a subdomain, such as news.yourdomain.com, so a newsletter's reputation stays separate from the mail that must arrive, like sign-in links and receipts. Each subdomain then needs its own SPF and DKIM records.

How do you set it up before launch?

A short order of work:

1. List every service that sends mail as your domain: your inbox provider, product email, newsletter tool, support desk, billing.
2. Add each service's DKIM records, and fold all of them into one SPF record.
3. Publish a DMARC record at p=none with a reporting address.
4. Send a test from each service to a Gmail address and check the message details show SPF, DKIM and DMARC passing.
5. Read the DMARC reports for a few weeks, fix any sender that fails, then tighten the policy.

Email is one line of a longer list. The pre-launch website checklist covers the rest of what's worth checking before launch day.

Check all three in a minute

These free tools ask public DNS only, need no sign-up and never visit your website:

• The email DNS checker looks up your SPF record (present, a single record, within the 10-lookup limit and how it ends), your DMARC policy and whether reports go anywhere, a DKIM selector at the common names, BIMI, who handles your mail (MX) and DNS, whether the zone is DNSSEC-signed, and CAA records. A custom DKIM selector it can't guess shows as not found, so check the one your provider gave you.
• The domain age checker reads your domain's registration and expiry dates, registrar and status from the registry's RDAP record, so you know how new your domain looks to a spam filter and when it needs renewing.

When your emails are ready to land, list your product on MakerRadar for launch day.