SPF, DKIM and DMARC deliverability basics Advanced
If your bot sends mail from your domain, three DNS records help inboxes trust it: SPF, DKIM and DMARC.
What you'll learn
- What each record does
- How to add them
- Big-sender rules
Before you start
- The Grok Bot app, installed and signed in. New? See where to download it and installing and signing in.
- A domain you control.
- A sending service (for example one in this guide).
1. In plain words
- SPF: a list of servers allowed to send for your domain.
- DKIM: a digital signature on each email proving it wasn't changed.
- DMARC: tells inboxes what to do if SPF/DKIM fail, and where to send reports.
These are DNS records, entries in your domain's settings.
2. Steps
- In your sending service, add your domain; it shows the exact SPF and DKIM records.
- Add them in your DNS provider.
- Add a DMARC record, starting gently, e.g.
v=DMARC1; p=none; rua=mailto:[email protected]. - Wait for the service to show "verified".
- Later, tighten DMARC to quarantine or reject.
3. Big-sender rules
Google requires bulk senders (5,000+ messages a day to Gmail) to use SPF, DKIM and DMARC, offer one-click unsubscribe for marketing mail, and keep spam rates low. Yahoo and Microsoft have similar requirements. Even small senders benefit from setting them up.
Ideas to try
- New domain.
Check my domain's SPF, DKIM and DMARC and explain what's missing. Don't change DNS.
- Spam problem.
My invoices land in spam. Help me find out why.
- Reports.
Read this DMARC report and explain it simply.
- Planning.
What records do I need to send from both Google Workspace and Resend?
Tips
- Only one SPF record per domain; combine entries.
- Change DNS carefully; mistakes affect all your mail.
- Start DMARC at p=none.
Facts about the Grok Bot app come from Cursor's official Grok Bot documentation. Docs: Google email sender guidelines, DMARC.org overview. Menus and services change; if something looks different, check the official docs or ask your bot.