Almost every domain I have taken over for a new client has email problems in waiting. Transactional emails landing in spam. Contact form notifications that never arrive. Newsletters that bounce. The root cause is almost always the same: no SPF, no DKIM, no DMARC.
These are not difficult to set up. They are just easy to skip when you are in a hurry to launch.
What these records actually do
SPF tells receiving mail servers which IP addresses are allowed to send email for your domain. Without it, anyone can send email claiming to be from your domain and receiving servers have no way to verify the claim.
DKIM adds a cryptographic signature to outgoing emails. The receiving server looks up your public key in DNS and verifies the signature. If the email was tampered with in transit, the signature fails.
DMARC tells receiving servers what to do when SPF or DKIM fails: ignore it, quarantine it, or reject it. It also sends you reports so you can see who is sending email on behalf of your domain.
Setting up SPF
SPF is a TXT record on the root of your domain. A typical setup where you send from your server and through a transactional email provider looks like this:
v=spf1 ip4:YOUR.SERVER.IP include:sendgrid.net include:_spf.google.com ~allThe ~all at the end means "soft fail anything not listed here" — it will land in spam rather than be rejected outright. Start with ~all, monitor your DMARC reports, then switch to -all (hard fail) once you are confident you have listed everything.
Important: one SPF record per domain. If you have multiple TXT records starting with v=spf1, SPF breaks. Merge them into one record using include:.
Setting up DKIM
DKIM requires generating a key pair. The private key lives on your mail server; the public key goes in DNS.
If you are using Postfix with OpenDKIM:
opendkim-genkey -t -s mail -d yourdomain.com
# Creates mail.private (keep this) and mail.txt (goes to DNS)The DNS record goes at mail._domainkey.yourdomain.com as a TXT record. The value from mail.txt looks like:
v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMI...If you send through a service like Mailgun, Sendgrid, or Postmark, they give you the DNS values to add. Each service uses its own selector (the part before ._domainkey), so you can have multiple DKIM records for different senders.
Setting up DMARC
DMARC goes at _dmarc.yourdomain.com. Start permissive and tighten it over time:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1p=none means "monitor but do not act." You will start receiving aggregate reports (rua) and forensic reports (ruf) from mail receivers. Read them for a few weeks to understand who is sending on your behalf.
Once you are confident, move to p=quarantine (spam folder for failures) and eventually p=reject (reject outright).
Verifying your setup
Send a test email to check-auth2@verifier.port25.com. You will get a reply showing whether SPF, DKIM, and DMARC all passed. Also useful: mail-tester.com gives you a score and shows exactly what is failing.
The result
Once SPF, DKIM, and DMARC are in place and aligned, transactional email deliverability improves dramatically. I have seen clients go from 30% of their contact form notifications landing in the recipient's spam folder to near-zero false positives after adding these three records. It takes about an hour to set up correctly. The absence of it can cost clients real business.