DKIM, SPF, DMARC Explained: Set Up Your Sending Domain in 10 Minutes
DKIM, SPF, DMARC Explained: Set Up Your Sending Domain in 10 Minutes
You've built your SaaS. Your signup flow works. But when you send that first welcome email, it lands in spam — or worse, doesn't arrive at all.
The problem isn't your code. It's your DNS.
Every domain that sends email needs three records to prove it's legitimate: SPF, DKIM, and DMARC. Without them, email providers treat your messages like forged spam. With them, your emails land in the inbox.
Let's fix that. In 10 minutes.
The Three-Layer Email Trust System
Think of email authentication like an ID check at an airport:
| Record | What it does | Airport analogy |
|---|---|---|
| SPF | Lists which servers can send mail from your domain | "This person is allowed to fly" |
| DKIM | Cryptographically signs every email so nobody can tamper with it | "This passport hasn't been forged" |
| DMARC | Tells receivers what to do when SPF or DKIM fail | "If ID doesn't match, deny entry" |
All three work together. SPF alone is weak. DKIM alone is incomplete. DMARC is toothless without both underneath. You need the full stack.
SPF (Sender Policy Framework)
SPF is a TXT record that lists every server authorized to send email on behalf of your domain.
What it looks like:
v=spf1 include:amazonses.com ~all
Broken down:
- v=spf1 — this is an SPF record
- include:amazonses.com — allow Amazon SES to send
- ~all — soft-fail everything else (mark as suspicious, don't reject yet)
Common mistake: Including too many services. SPF has a 10-DNS-lookup limit. If you use Mailgun + SendGrid + Gmail + your own server, you'll blow past it. Pick one sending service and stick to it.
MailAnvil's SPF: Since MailAnvil sends through AWS SES, your SPF record just needs include:amazonses.com. One include. Done.
DKIM (DomainKeys Identified Mail)
DKIM is the cryptographic layer. When you send an email, your sending server signs it with a private key. The receiving server checks the signature against a public key published in your DNS.
If the email was modified in transit — even one character — the signature breaks. The receiver knows it's been tampered with.
What it looks like (SES-generated):
Name: abcdefghij._domainkey.yourdomain.com
Type: CNAME
Value: abcdefghij.dkim.amazonses.com
That random-looking string (abcdefghij) is unique to your domain. SES generates it when you verify your domain.
MailAnvil's auto-DKIM: If your domain uses Cloudflare DNS, MailAnvil detects it and generates your DKIM records automatically. You click "Verify Domain" and all three CNAME records are created in seconds. No manual copy-paste. No typos. No "it's been 48 hours and DNS still hasn't propagated" anxiety.
If you're on another DNS provider (Route53, Namecheap, DigitalOcean), MailAnvil shows you exactly what to copy — three CNAME records, labels and values, ready to paste.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC is the policy layer. It tells receiving servers: "Here's how I authenticate my email. If a message fails, here's what to do with it."
What it looks like:
Name: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
Broken down:
- p=quarantine — send failing messages to spam (start here)
- p=reject — block failing messages entirely (move here after monitoring)
- p=none — monitoring only, don't take action (use during initial setup)
- rua= — where to send aggregate reports (optional but recommended)
Recommended rollout:
| Phase | Policy | Duration | What happens |
|---|---|---|---|
| 1 | p=none |
First week | Monitor — no email blocked |
| 2 | p=quarantine |
Week 2-4 | Failing email → spam folder |
| 3 | p=reject |
After 30 days clean | Failing email → blocked entirely |
Start with p=none, review the DMARC reports, make sure legitimate email passes, then tighten.
The Full Setup: Step by Step
Here's the complete DNS configuration for a domain sending through MailAnvil:
Step 1: Add SPF
Type: TXT
Name: @ (or yourdomain.com)
Value: v=spf1 include:amazonses.com ~all
TTL: Auto (or 3600)
Step 2: Add DKIM (MailAnvil auto-generates these)
Type: CNAME
Name: abcdefghij._domainkey.yourdomain.com
Value: abcdefghij.dkim.amazonses.com
Type: CNAME
Name: klmnopqrst._domainkey.yourdomain.com
Value: klmnopqrst.dkim.amazonses.com
Type: CNAME
Name: uvwxyzabcd._domainkey.yourdomain.com
Value: uvwxyzabcd.dkim.amazonses.com
SES generates three DKIM keys per domain. MailAnvil shows all three in your dashboard.
Step 3: Add DMARC
Type: TXT
Name: _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Step 4: Verify
# Check SPF
dig TXT yourdomain.com | grep spf
# Check DKIM
dig CNAME abcdefghij._domainkey.yourdomain.com
# Check DMARC
dig TXT _dmarc.yourdomain.com | grep DMARC
Or use MailAnvil's dashboard — the domain status page runs these checks and shows green checkmarks when everything resolves.
Why This Matters for Indonesian SaaS
Indonesian email providers (Yahoo Indonesia, custom corporate Exchange servers) are stricter than Gmail. BCA, Telkomsel, Gojek — they all run internal mail servers with aggressive spam filtering.
If your SaaS sends invoices, password resets, or notifications to Indonesian users, missing DKIM means your emails silently disappear. No bounce. No error. Just... nothing.
MailAnvil was built for this. Auto-DKIM for Cloudflare DNS. IDR pricing. Bahasa docs. QRIS/GoPay payments. Because "just use SendGrid" doesn't work when your customers pay in rupiah and read in Bahasa.
Quick Reference Card
| Record | Type | Name | Value |
|---|---|---|---|
| SPF | TXT | @ |
v=spf1 include:amazonses.com ~all |
| DKIM ×3 | CNAME | *._domainkey.yourdomain.com |
*.dkim.amazonses.com |
| DMARC | TXT | _dmarc |
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com |
Next Steps
- Sign up for MailAnvil (free — 500 emails/month)
- Add your domain in the dashboard
- Copy the DNS records (or let auto-DKIM handle it if you're on Cloudflare)
- Click "Verify" — wait 2-5 minutes for DNS propagation
- Send your first email:
POST /v1/send
Done. Your emails now land in inboxes, not spam folders.
Got questions? MailAnvil Docs has full API reference and setup guides. Need help in Bahasa? Our docs and support are bilingual.