Why Authentication Matters
Anyone can put your business name in the "From" line of an email. Authentication lets inboxes check whether an email claiming to be from your domain was really sent with your permission.
Without it, your emails are more likely to land in spam or be rejected, especially at Gmail, Yahoo and Outlook. See Gmail and Yahoo sender requirements.
The Three Records
A list of servers allowed to send email for your domain. Inboxes check whether the sending server is on the list.
A digital signature added to each email. Inboxes use a public key in your DNS to confirm the email wasn't altered and was authorized.
A policy that tells inboxes what to do when SPF or DKIM checks fail, and where to send reports.
How They Work Together
DMARC passes when at least one of SPF or DKIM passes and matches the domain in your From address. This matching is called alignment.
With many email marketing platforms, SPF passes on the platform's own domain rather than yours, so it doesn't align. That's normal. Custom DKIM signs your emails with your domain, which aligns and lets DMARC pass. That's why custom DKIM is usually the most important step.
Before You Start
- Own a domain, such as yourbusiness.com.
- Use a sending address on that domain, such as [email protected].
- Know where your DNS is managed. This is usually your domain registrar or web host, or a service like Cloudflare.
- List everything that sends email for your domain: your email platform, your regular inbox provider, your store or booking system.
Step-by-Step Setup
- Set up DKIM in your email platform. Find the domain authentication or sending domain settings. Many platforms can add records automatically if your DNS provider supports it; otherwise, copy the records shown, often CNAME records.
- Add the records in your DNS settings exactly as provided, then verify them in your email platform. DNS changes can take a while to take effect.
- Check your SPF record. Your domain should have only one SPF record. If your platform asks you to include it, add its value to your existing SPF record rather than creating a second one.
- Publish a DMARC record. Add a TXT record at _dmarc.yourdomain.com. Start with a monitoring policy of p=none, which doesn't block anything but enables reporting.
- Send a test email to yourself and check the message headers or use a free checker to confirm SPF, DKIM and DMARC pass.
A Starter DMARC Record
A simple starting DMARC record looks like this: v=DMARC1; p=none; rua=mailto:[email protected]. Replace the email address with one you control. Many people use a DMARC reporting service to make reports readable.
Once you're confident every legitimate sender passes, you can move to stricter policies such as "quarantine" and later "reject." Move gradually, because a strict policy will block any legitimate service you forgot to authenticate.
Setup in AWeber
AWeber's Domains and Addresses page guides you through custom DKIM for your sending domain. For supported DNS providers, AWeber can add DKIM and DMARC records automatically; otherwise it shows the records to add yourself. AWeber's guidance is to start DMARC with a policy of "none."
With custom DKIM in place, AWeber emails pass DMARC through DKIM alignment, even though SPF passes on AWeber's own return-path domain. See AWeber deliverability.
Common Mistakes
- Two SPF records. Combine them into one.
- Typos when copying records. Copy and paste rather than retyping.
- Jumping straight to p=reject, which can block your own legitimate email.
- Forgetting other senders, such as your store or invoicing tool.
- Sending from a free address like Gmail, which you can't authenticate.
AWeber guides you through custom DKIM and DMARC, with automatic setup for supported DNS providers.
SPF, DKIM and DMARC FAQs
What is the difference between SPF, DKIM and DMARC?
SPF lists allowed servers, DKIM signs each email and DMARC sets a policy for failures.
Do I need all three?
For marketing email at scale, yes. DKIM and DMARC are especially important with email platforms.
What DMARC policy should I start with?
Start with p=none to monitor, then move to stricter policies once everything passes.
Can I have two SPF records?
No. A domain should have one SPF record that includes all your senders.