Tactical Marketing
How-to guide

How to configure SPF, DKIM, and DMARC for marketing email

Email authentication is the foundation of deliverability. Misconfigured SPF, DKIM, or DMARC drags every other deliverability investment.

These three protocols work together. You need all three configured correctly, and you need DMARC alignment between them.

Steps

  1. 1

    Inventory sending sources

    Every system that sends email under your domain: marketing automation, transactional provider, sales engagement tool, internal apps, payroll, support desk. Each one needs to be authenticated.

  2. 2

    Build the SPF record

    Single SPF record per domain listing every authorized sending source. Watch the 10-DNS-lookup limit; consolidating include statements is often required at scale.

  3. 3

    Configure DKIM per source

    Each sending platform publishes its own DKIM keys. Use the platform's recommended selector; rotate keys per the platform's recommendation.

  4. 4

    Publish DMARC at p=none

    Start in monitoring mode (p=none) with aggregate reports going to an inbox you'll actually read. Watch the reports for a few weeks to identify misconfigured sources.

  5. 5

    Move to p=quarantine

    Once the legitimate sources all align, raise to p=quarantine. Watch reports for false positives.

  6. 6

    Move to p=reject

    Final step. Now unauthorized senders impersonating your domain are blocked outright. This is the goal state for any production sending domain.

  7. 7

    Add BIMI if applicable

    Brand Indicators for Message Identification. Useful but optional, requires DMARC at p=quarantine or p=reject and a verified mark certificate.

Common pitfalls

  • !Multiple SPF records on the same domain. Only one is allowed; multiple records cause SPF to fail entirely.
  • !Going straight to p=reject without monitoring. Legitimate senders get blocked.
  • !Forgetting subdomains. Subdomains need their own DMARC policy or they inherit nothing.

Frequently asked questions

QDo we need a separate subdomain for marketing email?+
Strongly recommended. Reputation isolation between marketing and transactional sending streams protects critical email from reputational damage on the marketing side.
QHow long does it take to move from p=none to p=reject?+
Typically four to twelve weeks of monitoring. Faster if the sending source landscape is small and well-documented.
QWill DMARC affect our open rates?+
Indirectly, yes. Mailbox providers treat DMARC-aligned mail more favorably, which improves inbox placement and therefore open rate.

Related services

Email Deliverability
Authentication, reputation, list hygiene.
Marketing Automation Services
The full service catalog behind the operating layer.
Marketing Operations Consulting
Senior ownership of the operational layer.
HubSpot Implementation
HubSpot stood up to survive operations.
Apply this in practice

Need senior help applying this in your environment?

Reading the guide is one thing. Translating it into the live system you actually have to operate on Monday is another. That's where the conversation usually starts.

Talk with PhilOperations Hub