<aside> ⚙️

SPF, DKIM, and DMARC sound intimidating but the concept is simple: they're how you prove to Gmail, Outlook, and Yahoo that an email claiming to be from your domain actually is from your domain. Get these three right and you've solved the biggest deliverability lever there is.

</aside>

The simple explanation

Think of your domain like your home address, and email authentication like ID checks at the door:

• SPF = a guest list. It tells inbox providers "these are the only servers allowed to send mail claiming to be from my address."
• DKIM = a wax seal. It cryptographically signs the email so the receiving server can confirm the message wasn't tampered with in transit.
• DMARC = the instructions for the bouncer. It tells inbox providers "if SPF or DKIM fails, here's what to do — let it through, send it to spam, or reject it outright."

All three work together. None of them alone is enough.

SPF (Sender Policy Framework)

• What it actually does

Example SPF record:

v=spf1 include:_spf.klaviyo.com include:_spf.google.com ~all

Key things to know:

• You can only have one SPF record per domain — if you add a new platform, you edit the existing record, you don't create a second one
• ~all (softfail) is standard for most senders; -all (hardfail) is stricter but riskier if you forget to list a sender
• SPF breaks when an email is forwarded — this is one reason DKIM matters just as much