Email Authentication: SPF, DKIM, DMARC, and BIMI Explained

1. SPF (Sender Policy Framework)

SPF is a list of servers that are allowed to send email on behalf of your domain.

When you use an email service provider (ESP) like MailerLite, ConvertKit, or ActiveCampaign, they are sending emails from their servers, but using your domain in the From: address. SPF tells receiving inboxes: “Yes, I authorize this specific ESP to send mail for me.”

How it works

You publish a TXT record in your domain's DNS settings. It looks something like this:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

When an email arrives, Gmail checks the sender's IP address against this list. If the IP isn't on the list, the email fails SPF.

Common SPF mistakes

• Multiple SPF records: You can only have one SPF record per domain. If you use multiple services (e.g., Google Workspace and Mailchimp), you must combine them into a single record.
• Too many lookups: SPF has a strict limit of 10 DNS lookups. If your record requires more than 10 lookups to resolve, it will fail.

2. DKIM (DomainKeys Identified Mail)

DKIM is a digital signature attached to every email you send.

While SPF verifies the server the email came from, DKIM verifies that the content of the email was not tampered with while in transit.

How it works

Your ESP generates two cryptographic keys: a private key and a public key.

1. The private key is kept secret by your ESP and used to sign every outgoing email.
2. The public key is published by you in your DNS settings (usually as a CNAME or TXT record).

When an email arrives, the receiving server looks up your public key and uses it to verify the signature. If it matches, the email is authentic.

3. DMARC (Domain-based Message Authentication)

DMARC (Domain-based Message Authentication) is the policy that ties SPF and DKIM together.

Before DMARC, if an email failed SPF or DKIM, the receiving server had to guess what to do with it. DMARC lets you, the domain owner, tell them exactly what to do.

How it works

You publish a TXT record for _dmarc.yourdomain.com.
DMARC checks two things:

1. Did the email pass SPF or DKIM?
2. Alignment: Does the domain that passed SPF or DKIM match the domain in the visible From: address? (This is a critical step where many senders fail, resulting in emails suddenly going to spam).

If the email fails these checks, your DMARC policy tells the receiver how to handle it:

• p=none: Do nothing (monitor only).
• p=quarantine: Send it to the spam folder.
• p=reject: Block it entirely.

If you are setting this up for the first time, always start with p=none so you don't accidentally block legitimate mail.

4. BIMI (Brand Indicators for Message Identification)

BIMI is the newest addition to the authentication stack. Once you have a strict DMARC policy in place (quarantine or reject), BIMI allows you to display your brand's verified logo next to your messages in the inbox.

It provides a visual indicator of trust to your recipients. Setting up BIMI requires publishing a SVG logo and, for some providers, a Verified Mark Certificate (VMC).

The setup checklist

To ensure your email deliverability isn't penalized by technical failures, verify these three things:

1. You have exactly one SPF record containing all your sending services.
2. DKIM is configured and actively signing emails from your custom domain (not your ESP's default domain).
3. You have a DMARC record published, even if it is just set to p=none.

Once these are in place, you can move on to the actual factors that dictate inbox placement, like email list building and hygiene.