Understand the roles without mixing the signals
SPF checks authorization of a sending system for an envelope identity. DKIM uses a signature associated with a signing domain. DMARC evaluates alignment with the visible From domain through SPF or DKIM. Authentication success does not guarantee inbox placement. Consult current specifications and your provider’s configuration instructions before making changes.
Build your sender inventory
Use one row for each legitimate service—not just the platform used for newsletters. Password resets, receipts, support replies and old automations can use different routes.
| Inventory field | Question to answer |
|---|---|
| Business use | Which team and message type depend on this sender? |
| Visible From | Which domain does the recipient see? |
| Technical owner | Who can change the service and DNS? |
| Evidence | Do recent headers match the intended setup? |
| Change plan | How will you verify and roll back a change? |
Review failures before enforcing a policy
Do not jump from an unknown sender inventory to a restrictive policy. Identify legitimate services and investigate their authentication results first. Keep the previous configuration and a rollback plan. DNS editing should be performed by an authorized administrator who understands the affected systems.
Choose the right follow-up
Use aggregate reports to investigate patterns across senders. Use a controlled message test to inspect a specific route. Keep those investigations separate from whether subscribers engaged with the campaign. For implementation details, follow the current DMARC specification rather than an old blog’s example record.
A question worth asking
If DKIM passes, is DMARC automatically passing?
Not necessarily: the authenticated identifier also needs the required alignment with the visible From domain. Review the actual authentication results and current specification.
Sources and scope
Checked: Public documentation linked below and the decision framework described on this page.
Not independently tested: Product accuracy, paid account workflows, support or delivery outcomes.
Reader should verify: Current terms and suitability for the actual sending setup. Never change production DNS from a generic example.
Last checked: September 2026.
Continue your investigation
Choose the next guide for the question that remains unanswered:
- How to read DMARC reports without guessing
- Gmail sender requirements: an operational checklist
- Pre-send email checklist: a repeatable test protocol
Partner link. Conditions can change; testing does not guarantee delivery.