SPF, DKIM and DMARC for small senders: setup and fixes
Set up SPF, DKIM and DMARC for your sending domain, meet Gmail and Yahoo sender rules, and fix the authentication errors email tools report.
First establish where you stand: which domain your From address uses, which services send mail for that domain (your inbox provider, your email platform, any store or booking tool), and whether you already publish SPF, DKIM and DMARC records. Most authentication problems come from a sender that was forgotten in that list, so write it down before changing DNS.
If you are starting from scratch, read the bulk sender requirements checklist first to see what mailbox providers expect, then the DNS records walkthrough for your registrar, then the DMARC rollout guide so you move from monitoring to enforcement without blocking your own mail. The subdomain guide helps if you want newsletter reputation kept separate from everyday business email.
If something is already failing, go straight to the fix-it page that matches the error: alignment failures, the SPF lookup limit, a platform reporting that domain authentication failed, or a rejected free-mail sender address. After any change, use the DMARC aggregate reports guide to confirm that legitimate mail now passes.
What Gmail and Yahoo require from every sender and from bulk senders: authentication, DMARC, one-click unsubscribe, unsubscribe timing and the 0.3% spam-rate line.
Follow Google's recommended DMARC rollout: monitor with p=none, move a small percentage to quarantine, then decide whether reject is worth it. Includes a record-by-record plan.
BIMI puts your logo next to your emails in some inboxes. Here are the sourced requirements (DMARC at enforcement, SVG Tiny PS, a VMC or CMC certificate), which mailbox providers show logos, what certificates cost, and reasons to skip it.
Why SPF fails with more than 10 DNS lookups, how to count them in a real record (nested includes count too), and which fixes are safe (remove unused includes, drop a and mx, move senders to subdomains) versus risky (flattening).
Step by step from Namecheap's and MailerLite's help pages: where to click in Advanced DNS, what goes in the Host field, when a record is TXT or CNAME, how long to wait, and the copy-paste mistakes that make verification fail.
Newsletter platforms refuse free mailbox addresses as the From address because you cannot authenticate a domain you do not control. Here are the published DMARC policies of gmail.com, yahoo.com and outlook.com, what Gmail and Yahoo require, and the cheapest compliant setup.
What RFC 8058 one-click unsubscribe requires, what Gmail and Yahoo ask of bulk senders, how to confirm the headers in a message you receive, and how to handle unsubscribes triggered by security scanners.
A field-by-field walk through a DMARC aggregate (rua) report using the current RFC 9990 format, an annotated example, a method for spotting unknown senders, and a rule for when a report parser is worth paying for.
What a sending subdomain such as news.yourdomain.com does and does not separate from your main domain, how DMARC alignment and policy inheritance work with it, and the DNS steps in MailerLite and Namecheap.
MailerLite's own troubleshooting steps for a failed domain check: host fields with the domain added twice, duplicate SPF records, proxied CNAMEs, the wrong DNS host and propagation, with Namecheap and Cloudflare checklists.
Moosend's documented sender verification and SPF, DKIM and DMARC steps, the common reasons a sender is rejected or stays unverified, provider-specific host names, and a final check against Gmail and Yahoo bulk-sender rules.
Plain definitions of every email authentication term a small sender meets, from envelope from and header from to alignment, selectors, p= and rua=, include, PTR and ARC, with an annotated header example showing where each one appears.
Research guide based on published standards and vendor documentationRead guide
A mechanism-by-mechanism reading of a real-format SPF record based on RFC 7208, what ~all, -all, ?all and +all actually return, why a domain can only have one SPF record, and a worked example merging three senders into one.
Research guide based on published standards and vendor documentationRead guide
How the s= and d= tags locate a DKIM key, how to find the selector in a message header, the selector each major platform documents, key length choices, and a key rotation sequence that avoids failed signatures.
Research guide based on published standards and vendor documentationRead guide
The hop-by-hop reason forwarding breaks SPF, why DKIM is what keeps forwarded mail passing DMARC, what SRS and ARC each fix and do not fix, how Cloudflare, Namecheap and Gmail document their handling, and setups that keep forwarded mail landing.
Research guide based on published standards and vendor documentationRead guide
How to set up a verified sending domain in Kit: where the setting lives, the CNAME records and Namecheap Host field rules, what changes in the return path and signatures after verification, how DMARC fits, and the ramp-up Kit recommends afterwards.
Research guide based on vendor documentation; not a hands-on testRead guide
How to add and verify your sending domain in Google Postmaster Tools, why dashboards can stay empty, what each dashboard means according to Google, and the spam-rate limits tied to Gmail bulk sender rules.
When a dedicated sending IP helps and when it hurts, the volume a provider says you need to keep one warm, what warm-up looks like in published schedules, and which email platforms offer a dedicated IP on which plan.