Deliverability 101: SPF, DKIM, DMARC, and the rest

There are three records you must publish, two headers you must sign, and one reputation that you must earn. This post walks through each in the order they matter.

SPF — Sender Policy Framework

A TXT record on your sending domain that lists which IPs may send mail "from" that domain. Receivers do a DNS lookup, find your SPF record, and reject mail whose source IP is not on the list.

dnsacme.dev. IN TXT "v=spf1 include:_spf.voltmail.dev ~all"

DKIM — DomainKeys Identified Mail

A cryptographic signature in every email's headers. Receivers fetch your public key from DNS and verify the signature. Bonus: forwarders that preserve the body don't break your auth.

Why two selectors?

Two DKIM selectors lets you rotate keys with zero downtime. While selector A signs new mail, selector B is still trusted. Promote, demote, repeat — quarterly is a healthy cadence.

DMARC — the policy on top

A TXT record at _dmarc.acme.dev that tells receivers what to do when SPF + DKIM both fail. Three policies: none (just report), quarantine (spam folder), reject (bounce).

• Start with p=none and a rua= reporting address. Read the reports.
• Once you can identify all your senders, move to p=quarantine.
• Once quarantine has been quiet for 30 days, move to p=reject.

List-Unsubscribe — the new compliance line

Since February 2024, Gmail and Yahoo require a one-click List-Unsubscribe header on every bulk email — and a working endpoint that honors the unsub within 48 hours. We honor it in <200ms; you can configure the destination URL per-domain.

Reputation — the meta-signal

Every receiving ISP keeps a per-IP and per-domain reputation score. Below a threshold, you go to spam. We plot live reputation at Gmail, Microsoft, Yahoo, AOL, Mail.ru, Apple iCloud, and 14 other ISPs in the dashboard. See a dip; investigate before bounce-rate confirms it.