Domain authentication: SPF, DKIM and DMARC

Who this is for: anyone sending from their own domain (you@yourcompany.com). If you send from a plain @gmail.com or @outlook.com address, Google or Microsoft already handle this for you and you can skip ahead.

Gmail, Outlook and Yahoo check three DNS records on every email to decide whether it really comes from your domain. Emails from a domain without them are far more likely to land in spam, and bulk senders without them can be rejected outright. Our acceptable use policy asks you to send only from domains with SPF, DKIM and DMARC set up.

Note: Swift Outbox sends through your own email provider (Google Workspace, Microsoft 365, Zoho or your host) over SMTP. So you set these records up for your email provider, not for us. The app does not check your DNS records for you.

The three records in plain words

Set them up

Do this once per domain you send from. You need access to your email provider’s admin console and to your DNS host (where your domain’s records are managed: your registrar, Cloudflare, your web host).

1. Find your provider’s guide. Search your provider’s help for “set up SPF” and “set up DKIM”. Google Workspace, Microsoft 365 and Zoho each have a step-by-step page with the exact values.
2. Add SPF. Create or edit the single TXT record on your domain that starts with v=spf1. Your provider tells you what to include, for example include:_spf.google.com for Google Workspace. A domain must have only one SPF record; if one exists, add your provider to it instead of creating a second.
3. Turn on DKIM. In your provider’s admin console, generate a DKIM key, add the record it shows at your DNS host, then click the provider’s start or enable button.
4. Add DMARC. Create a TXT record named _dmarc with a monitoring policy to start, for example v=DMARC1; p=none; rua=mailto:you@yourdomain.com. After a few weeks of clean reports you can tighten p=none to p=quarantine.
5. Wait and check. DNS changes can take up to 48 hours. Then send a test email from Settings > Sending accounts > Send test to a Gmail address, open it, choose Show original, and look for PASS next to SPF, DKIM and DMARC.

Warning: Do not copy SPF or DKIM values from another company’s guide or from this page. Use the values your own email provider gives you. A wrong SPF record can block all your email, not only campaigns.

Use a separate domain for cold email

Many teams send cold email from a second domain (for example getyourcompany.com next to yourcompany.com), so a deliverability problem never touches the domain your customers and staff use every day. Set up SPF, DKIM and DMARC on that domain too, and point its website at your main site.

Tip: Give a brand-new domain and its mailboxes a few weeks of low, steady sending before you scale. See Daily limits and sending windows.

Common mistakes

• Two SPF records. Only one is allowed. Merge them into one v=spf1 record.
• DKIM record added but never enabled. Most providers need you to click “start authentication” after the DNS record is in place.
• Jumping straight to p=reject. Start DMARC at p=none, read the reports, then tighten.
• Custom tracking domain without a matching record. If you use a tracking domain, it needs its own CNAME. See Open and click tracking.

Next step

Decide whether to track opens and clicks: Open and click tracking.