Glossary · Sales & distribution
SPF, DKIM and DMARC meaning
SPF, DKIM and DMARC are DNS records that prove an email really came from your domain and tell inboxes what to do if it did not. What each one does.
What does each of SPF, DKIM and DMARC do?
| Standard | Full form | What it checks |
|---|---|---|
| SPF | Sender Policy Framework | Was this message sent from a server the domain has authorised? |
| DKIM | DomainKeys Identified Mail | Does the message carry a valid signature from the domain, unchanged in transit? |
| DMARC | Domain-based Message Authentication, Reporting and Conformance | Did SPF or DKIM pass for the same domain shown in the From address, and what should happen if not? |
The key idea in DMARC is alignment. A message can pass SPF for a mailing service's domain while showing your domain in the From line. DMARC only counts a pass if the authenticated domain matches the visible one. If you send outreach from your own Gmail, for example through AutoGrow AI sales outreach by Autowhat, these records on your domain decide whether that mail is trusted.
A worked example (illustrative records)
Suppose a company sends from Google Workspace on the domain example.in. Its DNS might hold:
- SPF (TXT on example.in):
v=spf1 include:_spf.google.com ~all - DKIM (TXT on google._domainkey.example.in): the public key generated in the Workspace admin console
- DMARC (TXT on _dmarc.example.in):
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.in
With p=none, inboxes deliver failing mail as usual but send aggregate reports. After reviewing those reports and fixing every legitimate sender, the company can move to p=quarantine (failing mail goes to spam) and later p=reject. The domain and records here are illustrative; copy the exact values from your email provider.
Why do SPF, DKIM and DMARC matter for sales outreach?
Google's email sender guidelines require senders to Gmail accounts to authenticate their mail, and expect higher-volume senders to have SPF, DKIM and a DMARC record. Unauthenticated mail may be rejected or sent to spam. For an Indian B2B team sending cold email from a new domain, these records are the first step, before warm-up or copywriting. The lead list hygiene guide covers the next step.
What are the common mistakes?
- Two SPF records. A domain must have only one SPF record. Merge every sender into a single line.
- Too many lookups. SPF allows a limited number of DNS lookups (ten, per RFC 7208). Stacking many
include:entries breaks it silently. - Forgetting third-party senders. The billing tool, CRM and newsletter service all send as your domain and each needs SPF or DKIM set up.
- Leaving DMARC at p=none forever. It reports problems but blocks nothing, so spoofed mail still reaches inboxes.
- Jumping straight to p=reject. Without reading reports first, legitimate invoices or alerts can vanish.
SPF vs DKIM: which one matters more?
Neither alone is enough. SPF breaks when mail is forwarded, because the forwarding server is not on your list. DKIM survives forwarding but not a message altered in transit. DMARC needs only one of the two to pass with alignment, which is why setting up both gives the most reliable result.
Related terms
Read next
Where this shows up in our work. AutoGrow: AI writes every email and WhatsApp from the prospect’s website; IndiaMART and TradeIndia answered in seconds; one live funnel. Book a 30-minute working session with an engineer.
Questions
What is the meaning of DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a DNS record that tells receiving inboxes what to do with mail that fails SPF and DKIM alignment and where to send reports.
Do I need all three of SPF, DKIM and DMARC?
For any domain that sends business or sales email, yes. SPF and DKIM authenticate the message, and DMARC ties them to your visible From address. Gmail's sender guidelines expect them from higher-volume senders.
What does p=none mean in a DMARC record?
It is a monitoring policy. Inboxes deliver mail that fails DMARC as they normally would but send you reports, so you can find every legitimate sender before moving to quarantine or reject.