Do I need all three of SPF, DKIM and DMARC?

Gmail and Yahoo require SPF or DKIM from every sender, and SPF, DKIM and DMARC from bulk senders. Setting up all three is the safe default even at low volume.

What DMARC policy should I start with?

p=none with a reporting address. It changes nothing about delivery but sends you reports showing which services send as your domain. Move to quarantine or reject once everything legitimate passes.

Can I have two SPF records?

No. A domain must publish only one SPF record; two cause a permanent error. Combine all senders into a single record.

SPF, DKIM and DMARC: what they mean

SPF: who may send

SPF (RFC 7208) is a TXT record on your domain listing the servers allowed to send its mail. A domain sending through Google Workspace and one marketing tool might publish:

v=spf1 include:_spf.google.com include:mail.example-esp.com ~all

The receiver checks the connecting server's IP against this list. ~all means treat everything else as a soft fail; -all means fail it outright.

The 10-lookup limit. RFC 7208 caps the DNS-querying terms in an SPF check (include, a, mx, ptr, exists and redirect) at 10. Exceed it and the result is a permanent error, which counts as a failure. Every tool you add with include: can bring its own nested lookups, so busy domains hit this more often than people expect.

DKIM: was it changed?

DKIM (RFC 6376) adds a cryptographic signature to each message's headers. The public key sits in DNS at a selector, for example google._domainkey.yourdomain.com. The receiver fetches the key, checks the signature, and confirms the signed parts of the message were not altered. Each sending service usually gets its own selector and key.

DMARC: policy and alignment

DMARC (RFC 7489) is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

It does two things. It sets a policy for mail that fails (none, quarantine or reject), and it requires alignment: SPF or DKIM must pass for a domain that matches the From: address the reader sees. A message can pass SPF for a sending service's own domain and still fail DMARC, because that domain is not yours. The rua address receives aggregate reports showing who sends as your domain.

What Gmail and Yahoo require

Since February 2024, every sender to Gmail personal accounts must set up SPF or DKIM. Bulk senders, which Google defines as close to 5,000 or more messages a day to personal Gmail accounts, must set up SPF and DKIM and a DMARC record (p=none is acceptable), with the From: domain aligned to the SPF or DKIM domain. Yahoo's rules match: SPF or DKIM for everyone; SPF, DKIM and a valid DMARC policy of at least p=none for bulk senders.

A worked setup order

List every service that sends as your domain: workspace mail, newsletter tool, help desk, invoicing.
Turn on DKIM in each and publish its key.
Publish one SPF record that includes them all, and count the lookups.
Publish DMARC at p=none with a reporting address.
After a few weeks of reports, fix anything failing, then move towards quarantine.

Common mistakes

Two SPF records, or one over 10 lookups.
DKIM set up for the workspace but not for the marketing tool.
Jumping straight to p=reject and blocking your own invoices.

Related terms

Authentication is the base layer of email deliverability; without it, good cold email still lands in spam. Your DNS records also reveal your tools, which is one source of technographics.

Where Sluice fits

Sluice sends email through the Gmail or Outlook account you connect, so authentication is whatever your domain publishes. Check your records before connecting a mailbox.