Back to articlesDevelopment
Good email deliverability: DNS, SPF, DKIM, DMARC
Sending an email is easy. Getting it into the inbox is not. A tour of the DNS records that decide whether your campaigns land — or fall into spam.
#deliverability#dns#dmarc#spf#dkim
Mike Codeur
August 09, 20263 min
Good email deliverability
A sent email is not a received email. In between, mailbox providers — Gmail, Outlook, Yahoo — decide, in a few milliseconds, whether your message deserves the inbox, the spam folder, or outright rejection. That decision rests largely on three DNS records. Setting them up correctly isn't optional: since 2024, Gmail and Yahoo require them for any bulk sending.SPF — who is allowed to send for your domain
SPF (Sender Policy Framework) is a TXT record listing the servers authorized to send email on behalf of your domain.v=spf1 include:amazonses.com ~all
you@yourdomain.com, it checks that
the sending server is in this list. Otherwise, the message is suspect.
The trailing ~all means "everything else is questionable, but don't hard-fail." During
warm-up, that's the right setting.
DKIM — the signature that proves integrity
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message. The receiving provider fetches your public key via DNS and verifies the message wasn't altered in transit. It's the difference between "this message claims to be from you" and "this message is mathematically proven to be from you." Without valid DKIM, no sender reputation gets built.DMARC — the policy that ties it together
DMARC (Domain-based Message Authentication) tells providers what to do when SPF or DKIM fail, and where to send you the reports.v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
p=quarantine policy asks providers to spam-folder unauthenticated messages. You rarely
start with p=reject (hard rejection): better to watch the reports for a few weeks before
tightening.
Beyond DNS: reputation
The three records are a necessary condition, not a sufficient one. A fresh domain has no reputation, and providers distrust a sender jumping from zero to 20,000 sends overnight. Two survival rules:- Warm up gradually. Start with a few hundred emails to your most engaged contacts, then double every two or three days. Reputation is built on opens, not raw volume.
- Watch bounces and complaints. Past 5% bounces or a high complaint rate, providers penalize you. A clean list — no dead addresses, no unsubscribes — beats a large dirty one.
What AgentsMail handles for you
DNS configuration stays your responsibility — it's your domain. But DKIM signing, bounce handling, and the suppression list fed automatically by bounces and complaints are handled on the platform side. An email that bounced once is never sent again. That's the kind of detail that protects your reputation without you having to think about it.Written by
MC
Mike Codeur
Author
Related Articles
MarketingHow to write a marketing campaign that gets read
A good marketing email isn’t a pretty one. It’s one that gets opened, read, and clicked. Subject line, structure, call to action: the principles that actually matter.
Aug 09, 20263 min
Read more
BusinessYou don’t need a bloated platform to send email
AgentsMail is an email marketing platform driven by API and AI agents. Cheaper than Mailchimp, simpler to use, and without the features nobody opens.
Aug 09, 20262 min
Read more
TechnologyDriving email campaigns with AI agents
When every action is an API call, an AI agent can do all the work: write, target, send, measure, repeat. Here’s what that looks like in practice.
Aug 09, 20263 min
Read more