Authenticate your domain (SPF, DKIM, DMARC)
Reviewed by Eran Betzalel, founder · 2026-06-29
Authenticating your domain means adding three DNS records, SPF, DKIM, and DMARC, that prove to mailbox providers your campaigns really come from you. It is the single most important deliverability step you can take, and Boostmail is built to help campaigns reach a 95% inbox placement rate when your domain is properly set up. Boostmail generates the exact records for your domain; you paste them into your DNS host and click Verify.
What each record does
- SPF (Sender Policy Framework) publishes the list of servers permitted to send email for your domain. Receivers check it to reject forged “from” addresses.
- DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message. The receiver verifies the signature to confirm the email wasn’t altered in transit and genuinely originated from your domain.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together. It tells inbox providers how to handle mail that fails authentication and can send you reports on who is mailing as your domain.
Together, these three turn an unverified sender into a trusted one, and major providers increasingly require them from bulk senders.
Use a branded sending domain
You can only authenticate a domain you control, so send from something like yourstore.com, not a free gmail.com or outlook.com address. Free-mailbox sending can’t publish these records and is treated with suspicion by receivers.
Add and verify the records
Open Settings → Deliverability in Boostmail and enter your sending domain. Boostmail produces the SPF, DKIM, and DMARC values for you. In your DNS provider (your registrar or DNS service), add each record exactly as shown, a stray space or wrong host name is the most common cause of failures. For DMARC, it’s wise to start with a monitoring policy (p=none) so you can watch reports before tightening to quarantine or reject.
Back in Boostmail, click Verify. DNS changes propagate anywhere from a few minutes to a few hours, so re-check if it doesn’t pass right away. A green status means you’re authenticated.
After authentication
Authentication gets you to the inbox; staying there depends on how you send. Continue with improve your sender reputation, and learn more about Boostmail’s deliverability features. If verification won’t pass, email [email protected].
- 1
Open domain authentication in Boostmail
Go to Settings → Deliverability (Sending domain) in Boostmail. Enter the domain you send from, ideally a branded domain like yourstore.com rather than a free gmail.com or outlook.com address, which cannot be authenticated.
- 2
Copy the DNS records Boostmail generates
Boostmail generates the exact SPF, DKIM, and DMARC records for your domain. Keep this screen open, you'll paste these values into your DNS provider.
- 3
Add the SPF record
In your DNS host (the registrar or service that manages your domain's DNS), add the TXT record Boostmail provides for SPF. SPF lists the servers allowed to send mail for your domain so receivers can reject forgeries.
- 4
Add the DKIM record
Add the DKIM record (usually a CNAME or TXT) exactly as shown. DKIM adds a cryptographic signature to every message so receivers can confirm it wasn't altered and really came from your domain.
- 5
Add the DMARC record
Add the DMARC TXT record at _dmarc.yourdomain. DMARC tells inbox providers what to do with mail that fails SPF or DKIM and lets you receive reports. Start with a monitoring policy (p=none) before tightening to quarantine or reject.
- 6
Verify in Boostmail
Return to Boostmail and click Verify. DNS changes can take anywhere from a few minutes to a few hours to propagate, so if it doesn't pass immediately, wait and re-check. A green status confirms your domain is authenticated.
Frequently asked questions
- What's the difference between SPF, DKIM, and DMARC?
- SPF lists which servers may send mail for your domain. DKIM cryptographically signs each message so receivers can verify it wasn't tampered with. DMARC ties the two together, telling inbox providers how to handle mail that fails and sending you reports. Together they prove your mail is genuinely from you.
- Do I really need all three?
- Yes. Major mailbox providers increasingly require proper authentication for bulk senders, and unauthenticated mail is far more likely to land in spam or be blocked. Setting all three up is the single biggest step you can take for inbox placement.
- Why won't a gmail.com or outlook.com address work?
- You can only authenticate a domain you control. Sending from a free mailbox address means you can't publish SPF/DKIM/DMARC for that domain, and providers treat such mail with suspicion. Use a branded domain like yourstore.com.
- It's not verifying, what should I do?
- DNS changes can take from a few minutes up to a day to propagate. Double-check that each record was pasted exactly (no extra spaces, correct host/name), wait a while, and click Verify again. If it still fails, email [email protected] for help.