SPF, DKIM, DMARC and Sender Reputation — How to Land Emails in the Inbox

Your emails land in spam? The client never sees them, the invoice doesn't arrive, the quote stays pending. The problem isn't content: it's the technical reputation of your domain. Without SPF, DKIM and DMARC, you're sending letters without envelopes — and providers will discard them.

We at Meteora Web see this daily: businesses losing sales because messages go to junk. We come from accounting: we know the cost of an unpaid invoice that ended up in spam. This is not theory — these are DNS records you can verify and fix today.

What is SPF and why do your emails get rejected without it?

SPF (Sender Policy Framework) tells receiving servers: "messages from this domain are only sent from these authorized IPs." Without SPF, anyone can send email pretending to be you. Providers then distrust your mail. For an Italian company using Gmail, Outlook, or a dedicated server, this is the first layer of protection.

Example TXT SPF record for a domain sending via Google Workspace and a dedicated IP:
v=spf1 include:_spf.google.com ip4:185.12.34.56 ~all

What does this record do? It authorizes Google's servers and one specific IP. The ~all tag means "accept but mark as softfail"; -all is stricter (reject). Start with ~all and move to -all once confident.

Immediate action

Log into your domain's DNS (e.g., Cloudflare, Aruba, SiteGround). Look for a TXT record with an empty name or @. If missing, add the value above adapted to your sending services. Then test with a tool like MxToolbox SPF lookup.

How does DKIM work and why is it your second trust factor?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the message. The destination server retrieves the public key from DNS and verifies the message hasn't been altered. Without DKIM, even with SPF, content can be tampered with.

Each sending service (Google, Mailchimp, your own server) generates a key pair. The private key stays on the sending server; the public key goes into a DNS TXT record with a selector (e.g., google._domainkey).

Example DKIM record for Google Workspace:
k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

Immediate action

Go to your email service panel (e.g., Google Admin > Apps > Gmail > Authenticate email) and generate a signature. Copy the record value to your DNS. Wait for propagation and verify with MxToolbox DKIM lookup.

What does DMARC do and how does it protect your domain from spoofing?

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receivers "what to do if SPF or DKIM fails." You can set no action (p=none), quarantine (p=quarantine), or reject (p=reject). Additionally you receive reports about who is trying to use your domain.

Basic DMARC TXT record for monitoring:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Caution: starting with p=reject without testing can block legitimate emails. We recommend: start with p=none, analyze reports for a week, then move to p=quarantine and finally to p=reject.

Immediate action

Set up an email address to receive aggregate reports (rua). Add the TXT record on _dmarc.yourdomain.com. Use tools like Dmarcian DMARC Check to verify.

How do you build sender reputation beyond DNS records?

SPF, DKIM, DMARC are the backbone. Reputation is built with:

• Clean lists: mail only to active addresses with explicit consent. Never buy lists.
• Gradual volume: if you send 10,000 emails from a new IP, providers see anomaly. Start with 500, then increase.
• Bounce rate under 5%: remove invalid or inactive addresses immediately.
• Spam complaints under 0.1%: monitor with feedback loops from Google, Yahoo, Outlook.
• Consistency: send regularly, not in bursts every six months.

We followed an e-commerce client sending 50k emails per month: a 10% bounce rate meant 5k undelivered. By cleaning the list over six months we dropped to 2% and deliverability went from 70% to 95%.

Immediate action

Export your list and remove all addresses that haven't opened in the last 6 months. Then configure a webhook or use an email marketing service that handles bounces automatically (e.g., Mailchimp, Sendinblue, or our Laravel stack).

What tools to use for ongoing deliverability monitoring?

Configuring once is not enough. Monitor deliverability:

• Google Postmaster Tools — if you send heavily to Gmail, shows spam rate, IP reputation, authentication.
• Microsoft SNDS — reports for Outlook/Hotmail.
• MXToolbox — quick SPF, DKIM, DMARC checks.
• Mail-Tester.com — send a test email and receive a score (10/10 is the goal).
• Dmarcian EU — analysis of aggregated DMARC reports.

We at Meteora Web automated monitoring for our clients: a crontab that daily checks blacklists, DNS records, and alerts if something changes. Even doing it manually once a month makes a difference.

Immediate action

Register at Google Postmaster Tools and add your domain. Send a test email to Mail-Tester.com. Follow the recommendations.

What to do right now — the deliverability checklist

1. Check if your domain already has SPF, DKIM, and DMARC with MxToolbox.
2. If SPF is missing: add the record authorizing your sending services.
3. If DKIM is missing: generate keys from your email provider and publish the DNS record.
4. If DMARC is missing: set p=none with rua to collect reports.
5. Clean your list: remove bounces and inactive addresses.
6. Monitor reputation with Postmaster Tools and Mail-Tester.
7. After two weeks of DMARC reports, increase policy to p=quarantine then to p=reject.

Want to dive deeper into how we integrate these checks into a marketing automation workflow? Read our pillar guide on Email Marketing and Marketing Automation.