SPF, DKIM, and DMARC checklist before you send

SPF, DKIM, and DMARC are the three DNS records that prove your domain authorized a message. Without them, inbox providers treat outbound as untrusted — even when you send through legitimate SMTP.

What each record does

1. SPF lists which servers may send mail for your domain.
2. DKIM cryptographically signs messages so receivers can verify they were not altered.
3. DMARC tells receivers what to do when SPF/DKIM fail, and where to send reports.

Checklist before day one

1. Pick one primary sending domain (or subdomain like mail.example.com).
2. Publish SPF that includes your SMTP / ESP includes.
3. Enable DKIM in your SMTP provider and add the public key DNS records.
4. Publish DMARC at p=none first so you can read reports without blocking mail.
5. Send test messages to Gmail and Outlook; confirm authentication passes in headers.
6. After a clean week of reports, tighten DMARC toward quarantine or reject if your volume is stable.

Common mistakes

• Multiple SPF records on one domain (merge into one).
• Signing with a domain that does not align with the From address.
• Jumping to p=reject before you know what fails.

OutboundOS sends through your SMTP, so domain authentication stays on infrastructure you control. Connect SMTP when you are ready.