If you're building a SaaS and plan to send emails to users — whether transactional, marketing, or outbound — email authentication is non-negotiable. Without proper SPF, DKIM, and DMARC records, your emails will land in spam or get rejected entirely.
Here's a practical, no-fluff guide to setting all three up correctly.
Why This Matters
Email providers like Gmail and Outlook use authentication records to decide whether your email is legitimate. If you skip this step:
- Your emails go to spam
- Your domain reputation drops
- Automated systems may block your domain entirely
This applies whether you're sending 10 emails or 10,000.
1. SPF (Sender Policy Framework)
SPF tells receiving servers which IP addresses are allowed to send email on behalf of your domain.
Setup
Add a TXT record to your domain's DNS:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
Replace the include: values with your actual email providers. Common ones:
| Provider | SPF Include |
|---|---|
| Google Workspace | _spf.google.com |
| SendGrid | sendgrid.net |
| Mailgun | mailgun.org |
| Amazon SES | amazonses.com |
Common Mistakes
- Having multiple SPF records (only one is allowed per domain)
- Using
+allinstead of~allor-all - Exceeding the 10 DNS lookup limit
2. DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to your outgoing emails. The receiving server checks this signature against a public key in your DNS.
Setup
Your email provider generates a DKIM key pair. You add the public key as a TXT record:
selector._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
Most providers (Google Workspace, SendGrid, etc.) walk you through this in their dashboard. The key thing is to make sure the selector matches what your provider expects.
Verification
Send a test email to a Gmail account and check the email headers. Look for:
dkim=pass header.d=yourdomain.com
3. DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails.
Setup
Add a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
Policy Levels
| Policy | Meaning |
|---|---|
p=none |
Monitor only (start here) |
p=quarantine |
Send failures to spam |
p=reject |
Block failures entirely |
Start with p=none to collect reports, then gradually move to quarantine and eventually reject once you're confident your legitimate emails are passing.
Verification Tools
Use these free tools to check your setup:
- MXToolbox — check SPF, DKIM, DMARC records
- Google Admin Toolbox — check MX records
- mail-tester.com — send a test email and get a score
Real-World Impact
Proper email authentication directly affects whether your emails reach inboxes. If you're building outbound features or any kind of email-sending functionality, this is foundational infrastructure.
I built ColdMailAI to help founders write better cold emails, and the number one question that comes up is deliverability. The answer almost always starts with "Did you set up SPF, DKIM, and DMARC?"
Quick Checklist
- [ ] One SPF record with all sending sources
- [ ] DKIM enabled for each sending service
- [ ] DMARC record starting with p=none
- [ ] Test email headers showing pass for all three
- [ ] Monitor DMARC reports for 2-4 weeks before tightening policy
If you're launching a product that sends email, get authentication right from day one. It's much harder to fix a damaged domain reputation than to set it up correctly from the start.
Questions? Drop them in the comments — happy to help debug specific setups.
Top comments (0)