Email Deliverability

Email authentication explained (SPF, DKIM, DMARC)

What these three DNS records do, why inbox providers now require them, and the one mistake to avoid.

To send email as your own domain and land in the inbox, you add a few records to your domain’s DNS — the internet’s address book for your domain. They prove the mail is really from you. There are three (plus one optional), and they’re simpler than they look.

The #1 mistake: don’t type your full domain in the host/name field. When we ask for a record named "focal._domainkey.yourdomain.com", you enter only "focal._domainkey". Almost every DNS provider adds your domain back on automatically — type the whole thing and you get "focal._domainkey.yourdomain.com.yourdomain.com", which silently fails. Enter only the part before your domain, and use "@" (or leave it blank — see your provider below) for the root.

SPF — who’s allowed to send

SPF is a single TXT record that lists which services are allowed to send email for your domain. The key rule: you may only have ONE SPF record. If you already send through another service (like Google Workspace), you don’t add a second one — you merge the new sender into the existing record by adding its “include”. It ends with "~all".

v=spf1 include:_spf.google.com include:<focal-send-host> ~all

Two SPF records on the same domain is the most common failure — it doesn’t average out, it breaks SPF entirely. Always merge into one.

DKIM — a tamper-proof signature

DKIM adds an invisible cryptographic signature to every email. The key that verifies it lives in DNS under a label called a “selector” (e.g. focal._domainkey). Most modern platforms, including Focal, use a CNAME record that points to a key we host — you paste one short value once, and we can rotate the key on our side without you ever touching DNS again. Multiple selectors coexist fine; your Google key and your Focal key don’t conflict.

DMARC — what to do with fakes

DMARC is a TXT record at "_dmarc.yourdomain.com" that tells inbox providers what to do with mail that fails the checks above, and where to send you reports. Always start gentle and ramp up:

p=none — monitor only, nothing is blocked. Start here.
p=quarantine — failing mail goes to spam.
p=reject — failing mail is refused outright.

Since February 2024, Google and Yahoo require bulk senders (over ~5,000/day) to have SPF, DKIM, and DMARC. As of 2025 this is actively enforced — so DMARC is no longer optional if you send volume.

Return-Path (optional but recommended)

A small CNAME on a subdomain (like bounce.yourdomain.com) points bounce handling at your own domain. It makes SPF line up with your “From” address, which strengthens your DMARC pass. Add it if your provider offers it.

Next step

Ready to add the records? Open the guide for your DNS provider — GoDaddy, Squarespace, Google Workspace, Cloudflare, Namecheap, and more — for the exact click-path.