SPF DKIM and DMARC explained for people who are not DNS nerds
inboxwhisper · 2026-02-11 · 4,340 views
I keep seeing people confused about email authentication so here is the simplest explanation I can give.
SPF (Sender Policy Framework): Tells receiving servers which servers are allowed to send email for your domain. Think of it as a guest list. If the sending server is not on the list, the email gets flagged. You set this up as a TXT record in your DNS. PuzzleInbox handles this automatically when they set up your Google Workspace inboxes.
DKIM (DomainKeys Identified Mail): Adds a digital signature to every email you send. The receiving server checks this signature against a public key in your DNS to verify the email was not tampered with in transit. This is like a wax seal on a letter. Again, PuzzleInbox configures this for you.
DMARC (Domain-based Message Authentication, Reporting and Conformance): Tells receiving servers what to do if SPF or DKIM fails. You can set it to none (just monitor), quarantine (send to spam), or reject (block entirely). Start with p=none and move to p=quarantine after you are confident everything is aligned.
The key thing most people miss: alignment. Your SPF domain, DKIM domain, and From domain all need to match. If they do not align, even if SPF and DKIM pass individually, DMARC will fail. This is the number one reason people on shared SMTP infrastructure have deliverability problems.
If you are using PuzzleInbox or any Google Workspace provider, alignment is handled automatically because you are sending from your own domain through Google servers. This is why dedicated Google Workspace inboxes outperform shared SMTP for cold email deliverability.
Use MXToolbox or the PuzzleInbox spam checker to verify all three are passing before you start any cold email campaign.
Comments (12)
noobsender · 2026-02-11
bookmarked. finally someone explains this without making my brain melt
warmup_wiz · MailReach · 2026-02-11
Good overview. One thing I'd add — make sure your DMARC policy is set to at least p=quarantine once you're confident SPF and DKIM are passing. A lot of people leave it on p=none forever and wonder why their deliverability plateaus.
jasoneng · 2026-02-12
the guest list analogy for SPF actually made it click for me. been doing cold email for 3 months and just now understand what these records actually do lol
tina_infra · 2026-02-12
One thing missing — SPF has a 10 DNS lookup limit. If you're using multiple sending services (like Instantly + your CRM + Google Workspace) you can hit that limit fast and your SPF silently fails. Ask me how I know lol
coldkingdom · 2026-02-12
alignment is the part that trips everyone up. your SPF and DKIM can both pass but if the domains dont align with your From address DMARC still fails. seen this break so many setups
sdrgirl · 2026-02-13
Saved this to share with my team! We just onboarded 3 new SDRs and none of them understood why DNS matters for cold email. This is required reading now.
dataderek · 2026-02-13
Pro tip: use dmarcian.com or MXToolbox to check your records after setting them up. The number of times I've seen people with typos in their SPF records is honestly embarrassing.
frustratedfrank · 2026-02-13
I set all three records up and my emails still land in spam. What else am I missing? Using Google Workspace with Instantly.
warmup_wiz · MailReach · 2026-02-13
@frustratedfrank DNS is necessary but not sufficient. You also need proper warmup (minimum 14 days), low volume (15-20 emails per inbox per day), and decent copy. DNS is just the foundation.
techsales22 · 2026-02-14
tbh i put off learning this stuff for way too long. just set up DKIM wrong on 4 domains last week because i was copying records from the wrong provider dashboard. double check everything
markw_cold · 2026-02-14
Great write up. Also worth noting — propagation can take up to 48 hours for DNS changes. Don't panic if things don't work immediately after you add records.
newbienick · 2026-02-15
simple question — do I need to set this up on every single domain or just my main one?