Skip to main content
← Back to the blog

Guides

Email Deliverability: SPF, DKIM & DMARC Setup

Published July 17, 2026 · 10 min read

FFlowgrationGUIDESEmail Deliverability: SPF,DKIM & DMARC Setup

Do you know how many emails never reach the inbox? Between 10% and 30%, depending on the industry. The culprit isn't your content—it's email authentication. Without SPF, DKIM, and DMARC, email providers (Gmail, Outlook, Yahoo) flag your messages as spam or reject them outright.

Since January 2024, Google and Yahoo require SPF and DKIM authentication for anyone sending over 5,000 emails daily. By 2026, it's mandatory even for smaller volumes. Without proper setup, your emails will vanish into spam.

The good news: configuring SPF, DKIM, and DMARC takes 20–30 minutes and multiplies your deliverability. This guide shows you exactly how.

What is email deliverability?

Deliverability means your email reaches the recipient's inbox (not spam, not rejected, not blocked).

It's different from "sending." You might send 10,000 emails today, but if 50% land in spam, your deliverability is 50%.

Key factors affecting deliverability:

  • Authentication (SPF, DKIM, DMARC)—most critical
  • Domain reputation (how many emails get marked spam)
  • Content (spam trigger words, suspicious links)
  • Clean list (you don't email invalid addresses)
  • Bounce rate (rejected emails)

Configure SPF, DKIM, and DMARC and you'll automatically gain 15–25 points in deliverability.

SPF, DKIM, and DMARC explained

SPF (Sender Policy Framework)

What it is: A DNS record that tells Gmail, Outlook, etc.: "These mail servers are authorized to send emails from my domain."

Why it matters: Without SPF, anyone can impersonate your domain. Spammers know this, so they send spam using your address. Gmail sees it's unauthorized and flags it as spam.

Simple example:

v=spf1 include:sendgrid.net include:mailchimp.com ~all

Translation: "SPF version 1. I authorize SendGrid and Mailchimp to send emails from my domain. Everyone else is suspicious but accepted (~all)."

SPF modifiers:

  • ~all = soft-fail (suspicious but accepted)
  • -all = hard-fail (rejected)

Start with ~all until you're confident.

DKIM (DomainKeys Identified Mail)

What it is: A cryptographic signature proving the email really comes from you. It's your digital signature.

Why it matters: Even if someone spoofs your SPF record, DKIM verifies message integrity. If someone alters the email after sending, DKIM detects it.

How it works:

  1. Generate a public and private key
  2. Store the public key in your DNS
  3. Your mail server signs each email with the private key
  4. Gmail verifies the signature against the public key
  5. If they match, the email is legitimate

In WooCommerce, if you use Flowgration or SendGrid, they manage DKIM for you. You just add the public key to DNS.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

What it is: A policy that says "What do I do if an email fails SPF or DKIM?" It also sends you reports about who's trying to use your domain.

DMARC policies:

  • p=none = monitor only, accept anyway
  • p=quarantine = send to spam if fails
  • p=reject = reject directly if fails

Why it matters: Protects you from impersonation. If someone sends spam with your domain and you have a reject policy, Gmail blocks it immediately.

Basic DMARC example:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:forensics@yourdomain.com

Translation: "DMARC v1. If SPF/DKIM fails, quarantine to spam. Send reports to dmarc-reports@yourdomain.com."

Why it's mandatory in 2026 (Google, Yahoo, and beyond)

In February 2024, Google and Yahoo announced that starting February 2024:

  • Senders of 5,000+ emails/day MUST have SPF and DKIM
  • Spam rate must be below 0.1%
  • Must support one-click unsubscribe

By 2026, the requirement has expanded to smaller volumes and other ISPs (Orange, Vodafone, Telia, etc.). Without SPF/DKIM, your emails won't pass filters.

It's so critical that Gmail now marks unauthenticated emails with a red "?" on the sender's avatar.

Configure SPF: step-by-step

Step 1: Identify your email provider

Where do your emails originate? WooCommerce native? SendGrid? Mailchimp? Flowgration?

Each has a specific SPF record.

Common providers:

  • SendGrid: sendgrid.net
  • Mailchimp: mailchimp.com
  • Google Workspace: aspmx.l.google.com
  • Amazon SES: amazonses.com
  • Flowgration: flowgration.com (if hosted)

Step 2: Access your DNS

Log into your domain registrar (GoDaddy, Namecheap, 1&1, Ionos, etc.) and find DNS Manager or Zone File.

Step 3: Add the SPF record

Find the TXT Records section (or SPF if there's a dedicated section).

New record:

  • Type: TXT
  • Name (Subdomain): @ (or your root domain)
  • Value:
v=spf1 include:sendgrid.net include:mailchimp.com ~all

(Replace with your actual providers. If using only SendGrid: v=spf1 include:sendgrid.net ~all)

Step 4: Wait for propagation

DNS changes take 24–48 hours to propagate. Verify early with online tools:

Enter your domain and search for the SPF record. It should show your new value.

Important: You can only have ONE SPF record per domain. If you already have one, ADD the new include: statement to the existing value. Don't create two records.

Wrong (DON'T do this):

v=spf1 include:mailchimp.com ~all
v=spf1 include:sendgrid.net ~all

Correct:

v=spf1 include:mailchimp.com include:sendgrid.net ~all

Implement DKIM: step-by-step

DKIM is more technical, but most providers auto-generate it for you.

Step 1: Generate DKIM keys

In your provider (SendGrid, Mailchimp, Flowgration):

  1. Go to Settings → Authentication → DKIM
  2. Select your domain
  3. Click "Generate DKIM" or "Create key"

The provider gives you:

  • Record name: something like s._domainkey.yourdomain.com
  • Record value: a long string (your public key)

Step 2: Add the DKIM record to DNS

In your registrar:

  • Type: TXT
  • Name: s._domainkey (or what your provider told you; some platforms say s._domainkey.yourdomain.com)
  • Value: the public key your provider generated

Example:

Name: s._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIGfMA0GCS...

Step 3: Verify in your provider

Once DNS propagates (24h), go back to your provider and click "Verify DKIM". It should say "Verified ✓".

Note: Some providers create MULTIPLE selectors (s1, s2, etc.). Add them all to DNS.

Configure DMARC: policy step-by-step

Step 1: Start with p=none

First, monitor without rejecting anything:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Add to DNS:

  • Type: TXT
  • Name: _dmarc (literal)
  • Value: the line above

Step 2: Monitor reports for 1–2 weeks

Gmail and others will send reports to dmarc-reports@yourdomain.com. You'll see:

  • How many emails passed authentication
  • How many failed
  • Who was trying to use your domain

Step 3: Upgrade to p=quarantine (then p=reject)

Once you're confident legitimate emails pass authentication, strengthen the policy:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:forensics@yourdomain.com; fo=1

Parameters:

  • p=quarantine: Fail → spam folder
  • p=reject: Fail → hard reject (stricter)
  • rua: Aggregate reports email (weekly)
  • ruf: Forensic reports email (per-message; only with fo=1)
  • fo=1: Send report if ANY of SPF/DKIM fails

After 2–4 weeks of clean results, upgrade to p=reject:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:forensics@yourdomain.com; fo=1

Deliverability checklist + DNS validation

Your configuration checklist

  • Identified your email provider (SendGrid, Mailchimp, etc.)
  • Added SPF record with v=spf1 include:[provider] ~all
  • Generated DKIM keys in your provider
  • Added DKIM record to DNS
  • Verified DKIM in provider dashboard
  • Added DMARC with p=none for monitoring
  • Waited 24–48h for propagation
  • Upgraded DMARC to p=quarantine after 1 week
  • Upgraded DMARC to p=reject after 2–4 weeks

Validation tools

  1. MXToolbox (https://mxtoolbox.com)

    • Go to "Check MX", "SPF Check", "DKIM Check", "DMARC Check"
    • Enter your domain
    • Should pass all

  2. Google Admin Toolbox (https://toolbox.googleapps.com/apps/checkmx/)

    • MX, SPF, DKIM, DMARC
    • User-friendly interface

  3. DMARC Report Analyzer (https://dmarc.agari.com)

    • View your DMARC reports
    • Detailed analysis

  4. Your provider (SendGrid, Mailchimp, etc.)

    • Native verification dashboard
    • Most reliable source

FAQ

Can I set up SPF without DKIM? Technically yes, but shouldn't. SPF alone is 60% protection. DKIM alone is 70%. Both together are 95%+. Do it right from the start.

Should I use p=reject or p=quarantine in DMARC? Start with p=quarantine. It's safer in case of misconfiguration. After 2–4 weeks of clean monitoring, upgrade to p=reject. p=reject is ideal but risky if something's misconfigured.

My email still goes to spam even with SPF/DKIM/DMARC. Why? Other factors matter:

  • Content (spam words: "free", "click here")
  • Dirty list (you email invalid addresses)
  • Engagement (open rate, click rate)
  • Old IP or poor reputation
  • Missing easy unsubscribe

Check all of them.

How long until deliverability improves after setup? 24–48h for DNS propagation. 1 week for Gmail to trust you. 2–4 weeks to see clear improvements. Be patient.

If I have multiple domains, do I configure everything on each? Yes. SPF, DKIM, and DMARC are per-domain. If you use mystore.com and blog.mystore.com, configure each one.

Without SPF, DKIM, and DMARC, your 2026 WooCommerce emails will disappear directly into spam. But with this guide, spend 30 minutes and gain 15–25% deliverability automatically.

The time you invest today will save you thousands in lost revenue from missed emails.

Ready to configure? Flowgration helps you validate email setup and optimize deliverability.

Build your WooCommerce CRM in 60 seconds

Flowgration turns your store's orders into a living CRM and runs email, SMS and WhatsApp on autopilot. Free up to 500 contacts.

Start free

Related guides

Related articles