Setting up SPF, DKIM and DMARC for an Email Domain

Setting up SPF, DKIM and DMARC for an Email Domain

Imagine you set up a mailing campaign, but 90% of your emails never reach the inbox — spam folders, blocks, blacklists. Without SPF, DKIM, and DMARC, your domain is an open target for phishers, and deliverability plummets. With Google and Yahoo now requiring these checks for senders with volumes over 5,000 emails per day, configuring these records is mandatory.

Recently, a client sending 10,000 emails per day faced an SPF PermError due to 14 DNS lookups. After SPF Flattening, deliverability jumped from 45% to 98% — a 2.2x increase. We help configure email domain protection end-to-end, ensuring your emails are guaranteed to be delivered. With experience on over 50 projects configuring mail infrastructure for high-traffic domains, results are assured.

According to statistics, 60% of all deliverability issues are caused by incorrect SPF and DKIM configuration. Meanwhile, 80% of companies do not use DMARC, leaving their domains unprotected. Our solution includes a full audit and phased implementation, reducing the risk of legitimate email blocking by 95% and cutting processing time at providers.

SPF — Sender Policy Framework

An SPF record lists the servers authorized to send emails on behalf of your domain. It is checked against the sending server's IP.

DNS TXT record for example.com:

v=spf1 include:sendgrid.net include:amazonses.com ip4:203.0.113.10 ~all

Syntax of mechanisms:

SPF Flattening — a solution for exceeding the DNS lookup limit. It replaces include: with concrete IP addresses, reducing the number of lookups by up to 40% compared to the original list. SPF Flattening can be done manually or via services like AutoSPF.

How to Perform SPF Flattening Manually (Step-by-Step)

1. Obtain the IP address list from each ESP (SendGrid, Mailgun, etc.) via their API or documentation.
2. Combine all IP addresses into a single SPF record using ip4 and ip6 mechanisms.
3. Ensure the total number of DNS lookups does not exceed 10 (use an SPF calculator).
4. Add ~all or -all at the end of the record.
5. Update the DNS record and wait for propagation (usually up to 15 minutes).

DKIM — DomainKeys Identified Mail

DKIM adds a digital signature to every email. The recipient verifies the signature using a public key in DNS.

Generating a key pair (for your own SMTP/Postfix):

openssl genrsa -out dkim_private.pem 2048
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

DNS TXT record:

default._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=<base64-public-key>"

For ESPs (Resend, SendGrid, Mailgun) — they generate the key pair and provide ready-made DNS records via their dashboard. Make sure to use the correct selector (usually default or s1).

DMARC — Domain-based Message Authentication

DMARC defines a policy for emails that fail SPF/DKIM:

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100; adkim=r; aspf=r"

# Implementation strategy:
# Step 1 — monitoring with p=none
# Step 2 — after 2-4 weeks p=quarantine; pct=10
# Step 3 — final p=reject; pct=100

DMARC (per RFC 7489) not only protects against phishing but also improves domain reputation. With p=reject, spam is rejected at the SMTP level, and Gmail and Yahoo consider DMARC policy when filtering.

Why DMARC Matters for Deliverability

DMARC not only protects against phishing but also enhances domain reputation. When set to p=reject, spam is rejected early in the SMTP handshake, and Gmail and Yahoo factor DMARC policy into their filtering decisions. Without it, even legitimate emails may land in spam due to partial SPF/DKIM alignment.

Comparison of DMARC Policies

DMARC with p=reject blocks up to 99% of phishing attacks, while p=none allows more than half to pass.

How to Avoid SPF PermError

PermError occurs when the 10 DNS lookup limit is exceeded. To avoid it:

• Use SPF Flattening — replace include: with concrete IP addresses from services (SendGrid, Mailgun).
• Leverage third-party tools like AutoSPF or EasyDMARC for automatic compaction.
• Minimize the number of include: statements — consolidate multiple records from the same provider.

BIMI — Brand Indicators for Message Identification

Display your logo in Gmail/Apple Mail inboxes — an additional step after DMARC p=quarantine or p=reject:

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/bimi.pem"

The logo must be in SVG Tiny 1.2 format. Apple Mail requires a VMC certificate from DigiCert/Entrust.

Verification of Settings

1. Send a test email to mail-tester.com and review your score.
2. Use MXToolbox (SPF, DKIM, DMARC checks).
3. Set up DMARC report monitoring via Valimail or Dmarcian.

Google Postmaster Tools help track your domain reputation in Gmail.

Common Issues

SPF PermError (too many DNS lookups): Apply SPF Flattening — replace include: with concrete IP addresses via third-party services.

DKIM verify failed: Ensure the ESP is configured to sign with the correct selector and that CNAME records are added to DNS.

DMARC not working: SPF and DKIM must pass alignment — the domain in the From: header must match the envelope-from domain (for SPF) or the d= domain in the DKIM signature.

What's Included in the Setup (Deliverables)

• Audit of current DNS records and mail infrastructure
• Generation and addition of SPF, DKIM, DMARC records
• Configuration of monitoring via DMARC analytics and Postmaster Tools
• Gradual policy rollout with report oversight
• Documentation of all changes and staff training
• Two weeks of post-completion support

Timeline

Typically, setting up SPF + DKIM + DMARC takes 1 to 2 days. With monitoring and a phased transition to p=reject, it can take up to 2 weeks. The cost is calculated individually.

Over 5 years of experience and more than 50 projects configuring mail infrastructure for high-traffic domains. Order an audit of your current settings — contact us for a consultation. Get a consultation on configuring your domain.

Email Campaign Integration: Why Does It Often Break?

We’ve observed that a trigger email sent 10 minutes after registration converts 4–5 times better than the same email sent after 24 hours. This isn’t a marketing myth—it’s mechanics: while the user is still warm, while they remember the context. But most integrations with email services are built like this: form submits → synchronous HTTP request to API → if the API is slow, the user waits 3 seconds → the email either goes out or doesn’t, nobody knows. In one project, we saw a 30% drop in conversion simply because the email service responded with 504 and Laravel’s queue driver wasn’t configured. Lost emails often hit customers silently – no log, no alert, just a missing order confirmation.

If you’re facing lost emails or spam folder issues, order an audit of your current integration – we’ll find bottlenecks within 2 days.

Providers and Their APIs

Unisender — a Russian provider popular in the SMB segment. REST API, simple. Adding a contact: importContacts, sending a transactional email: sendEmail. Important: for transactional emails (order confirmations, password resets), Unisender Go is a separate service with a different API and separate pricing. Mixing bulk and transactional mailings in one stream is bad for domain reputation. Unisender Go handles up to 1000 requests per second.

SendPulse — provides email, SMS, web push, Viber, and Telegram bots through a unified API. Convenient for projects requiring an omnichannel approach. Automation 360 is a visual chain builder; you can trigger automation via API events. The PHP SDK (sendpulse/rest-api-php-sdk) is maintained but updated irregularly – better to use Guzzle directly.

Mailchimp — a choice for international audiences and marketing teams accustomed to the Mailchimp ecosystem. Transactional email via Mandrill (a subsidiary service). Marketing API v3 for list, tag, and campaign management. Webhooks for opens, clicks, unsubscribes, bounces.

SMS. For Russia: SMSCenter, MTS Exolve, Devino Telecom, SMS Aero. Their APIs are similar: a send method with phone, message, sender parameters (sender name must be registered separately with the operator). One nuance: the sender name must be registered through the aggregator with a contract – otherwise SMS won’t be sent on MTS/MegaFon/Beeline networks.

How to Build an Integration That Doesn’t Lose Emails?

Separate Transactional and Marketing Streams

Transactional emails (order confirmations, password resets, delivery status) go through a dedicated sender domain or subdomain tx.example.com. Marketing campaigns go through mail.example.com or news.example.com. If a marketing campaign receives many spam complaints, it should not affect the reputation of the transactional stream. According to SendGrid documentation, transactional messages should be sent through a dedicated IP pool to prevent cross-contamination.

Queue and Retry

Any call to the email API goes through a queue (Laravel Queue, Bull, Celery). If Unisender returns a 503, the job retries after 5 minutes, then 15, then 60. After 5 failed attempts, it goes to a dead letter queue with an alert. The user already received their 200 OK and knows nothing about the issue. This approach reduces bounce rate on projects to 0.5%.

Example Laravel job:

public function handle(): void
{
    try {
        $response = Http::post(config('services.unisender.email_url'), $this->params);
        if ($response->failed()) {
            $this->release(300); // retry after 5 min
        }
    } catch (\Throwable $e) {
        $this->release(300);
    }
}

Templates

We store templates in code (Blade, Twig, React Email), not in the provider’s interface. Reasons: versioning via Git, browser preview without sending, testability. For complex templates with dynamic content — react-email with export to HTML via @react-email/render.

Validation and Consent

Before adding a contact to a list — double opt-in (confirmation email). Store the confirmation timestamp in your own database. Upon unsubscription — synchronously unsubscribe both at the provider and in your database. Ignoring webhook unsubscriptions is a direct path to account suspension at the provider. All processes comply with Федеральный закон № 152-ФЗ «О персональных данных».

Deliverability Monitoring and DKIM Setup

Connect provider webhooks for events: bounce (hard and soft), spam_complaint, unsubscribe. Hard bounce — immediately mark the email as invalid in your database, stop sending. Soft bounce 3 times in a row — same. Metrics: open rate, click rate, bounce rate, unsubscribe rate — review at least once a week. Our certified engineers configure alerts in Grafana/Prometheus.

DKIM configuration steps:

1. Generate a key pair (e.g., openssl genrsa -out private.key 2048).
2. Publish the public key in DNS as a TXT record for the selector (e.g., mail._domainkey.tx.example.com).
3. Provide the selector to the provider (SendGrid, Mailgun, Unisender).
4. Verify with dig TXT mail._domainkey.tx.example.com.

SPF, DKIM, DMARC must be configured separately for each stream. We use subdomains with different DNS records.

Why Is It Important to Separate Streams?

If you send a marketing campaign from the same domain as transactional emails and receive spam complaints, you risk getting the domain blocked — and users will stop receiving even order confirmations. SPF, DKIM, DMARC (Sender Policy Framework, DomainKeys Identified Mail, Domain‑based Message Authentication, Reporting and Conformance) must be configured separately for each stream. In one project, a marketing blast with 12% spam complaints blocked the transactional domain for 48 hours — we had to re‑authenticate with Google and Yandex.

What Does the Integration Scope Include?

• Audit of current communication streams and domain reputation (SPF, DKIM, DMARC)
• Provider and schema selection: transactional vs marketing traffic
• Configuration of SPF, DKIM, DMARC DNS records
• Development of email templates (HTML + dynamic content)
• Backend integration via queues and API
• Webhook setup for deliverability and complaints
• Operations documentation and team training
• Deliverability guarantee and post‑launch support

We deliver production‑ready documentation, access to monitoring dashboards, and a handover session with your engineers. Our certified engineers provide a 30‑day post‑launch health check guarantee.

Timelines and Cost

Cost is calculated individually after audit. We provide turnkey service: from analysis to production monitoring. Contact us for a free engineer consultation — we’ll evaluate your project and give accurate timelines. Over 7 years of experience in email service integration, 50+ projects implemented. Order a free audit of your current integration and receive a report with recommendations and estimated savings.