SPF, DKIM and DMARC: what they are and how to check yours

Draft — written from product facts + domain knowledge; UI labels to be verified before publishing.

SPF, DKIM and DMARC are three DNS records that prove your email really comes from your domain. Gmail, Yahoo and Microsoft require all three from bulk senders, and cold email counts as bulk. A domain missing any one of them lands in spam regardless of how good the copy is. Domains bought through Icemail get these records automatically; domains you bring yourself need them added by hand.

What each record does

SPF (Sender Policy Framework) — a TXT record at the root of the domain listing which servers may send mail for it. Example for Google Workspace:

v=spf1 include:_spf.google.com ~all

For Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all. One SPF record per domain only; multiple includes go inside the same record. Stay under 10 DNS lookups.

DKIM (DomainKeys Identified Mail) — a public key published at selector._domainkey.yourdomain.com. The mail server signs each message with the private key; receivers verify the signature. Google uses selector google; Microsoft uses selector1 and selector2 as CNAMEs. A DKIM signature also proves the message was not altered in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance) — a TXT record at _dmarc.yourdomain.com that tells receivers what to do when SPF or DKIM fail, and where to send reports:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

Policies: p=none (monitor only), p=quarantine (send failures to spam), p=reject (drop failures). Start at none, move to quarantine after 2–4 weeks of clean reports.

Steps: check your records

1. Open a DNS lookup tool (MXToolbox, Google Admin Toolbox Dig, or dig in a terminal).
2. SPF: look up TXT for yourdomain.com. You should see exactly one record starting v=spf1 that includes your provider.
3. DKIM: look up TXT (Google) or CNAME (Microsoft) for selector._domainkey.yourdomain.com. A result containing v=DKIM1 or a CNAME to the provider's key host means it is published.
4. DMARC: look up TXT for _dmarc.yourdomain.com. You should see one record starting v=DMARC1.
5. Send a test email from the mailbox to a personal Gmail account. Open the message → Show original. The headers should read SPF: PASS, DKIM: PASS, DMARC: PASS.
6. In OutreachFox, open Domain, select the domain and review its details and settings; fix any records flagged as missing at your DNS host.

What you see afterwards

All three headers show PASS in Gmail's "Show original" view, and the domain is ready for warm-up.

Tips

• Use ~all (softfail) in SPF for cold-email domains; -all is stricter and can cause hard rejections when a provider adds a new IP range.
• Add the DMARC rua address so you receive aggregate reports; a free DMARC report viewer makes them readable.
• Re-check records after moving mailboxes between providers. DKIM selectors are provider-specific.
• Icemail lets you set or remove DMARC per domain from its dashboard.

Troubleshooting / FAQ

• SPF PASS but DKIM FAIL. DKIM is not enabled in the provider's admin console, or the selector record is missing. In Google Admin: Apps → Google Workspace → Gmail → Authenticate email → Generate record → publish → Start authentication.
• Two SPF records. Merge them into one; two records is a permanent fail.
• "SPF PermError: too many DNS lookups". Remove unused includes; you have more than 10.
• DMARC PASS requires alignment. The From domain must match the SPF or DKIM domain. Sending from you@yourdomain.com through a provider that signs with its own domain fails alignment until DKIM is configured for your domain.

Related articles

• How Icemail automates SPF, DKIM and DMARC — and replaces mailboxes for free
• Adding DNS records at Cloudflare, GoDaddy, Namecheap and Porkbun
• Domain forwarding and MX records for cold-email domains
• Deliverability fundamentals for cold email
• Landing in spam? The recovery playbook