Authenticate your sending domain (SPF, DKIM, DMARC)
7 min read
When you send email, inbox providers like Gmail and Outlook quietly ask one question: can we trust that this message really came from who it claims to? Domain authentication is how you answer "yes." It's a one-time setup, and it's the foundation everything else in deliverability rests on.
Authentication happens through three short records you add to your domain's DNS settings. You don't need to understand the cryptography — you just copy three values BlueyEmail generates for you and paste them at your domain host. Here's what each one actually proves.
What SPF, DKIM, and DMARC each prove
Think of these three as a set of ID checks that work together. Each covers a different weakness a scammer might exploit.
- SPF (Sender Policy Framework) — a public list of which mail servers are allowed to send email on behalf of your domain. When a message arrives, the receiving server checks: "Did this come from a server on the approved list?" This stops strangers from sending as you.
- DKIM (DomainKeys Identified Mail) — a tamper-proof digital signature added to every message. If someone alters the email in transit — changes a link, swaps the reply-to — the signature breaks and the receiver knows. It proves the message wasn't meddled with after you sent it.
- DMARC (Domain-based Message Authentication) — your policy that ties the other two together. It tells receivers what to do when a message fails SPF or DKIM checks (ignore it, send it to spam, or reject it), and it asks them to email you regular reports so you can see who's sending as your domain.
They work as a team
SPF and DKIM do the checking; DMARC decides what happens on a failure and gives you visibility. You want all three in place — any one alone leaves a gap that filters notice.
Set it up in BlueyEmail
The whole process is copy-and-paste. BlueyEmail generates the exact records for your domain — you add them once at your DNS host and you're done for good.
- 1
Add your domain
Open Sending domains and click Add domain. Enter the root domain you send from (for example, yourcompany.com) — a domain you own and control — and confirm.
- 2
Copy the generated records
BlueyEmail lists the records to add — Ownership Verification, SPF, DKIM, and DMARC — each with a Host / Name and Value you can copy with one click. Copy them exactly; a stray space will cause verification to fail.
- 3
Add them at your DNS host
Log in wherever your domain lives (GoDaddy, Cloudflare, Namecheap, Google Domains, etc.) and add each one as a TXT record, pasting the Host and Value from BlueyEmail.
- 4
Verify
Back in BlueyEmail, click Re-check on the domain. (Opening the page re-checks your domains against live DNS anyway, so it may already have updated.) DNS changes can take a little time to spread — most resolve within an hour (allow up to 48). Each record flips from Pending to Verified as it resolves.
Verified is not the last step
Authentication is permission to send *for* your domain; it does not create an address to send *from*. Once every record passes, open Email accounts and add the address you want mail to come from — hello@yourcompany.com, say. It does not need to be a real mailbox: we sign and send as it, and replies follow your domain's existing MX records. If you only send over the API you can skip this and pass any address on the verified domain as from_email.
Free email domains can't be authenticated
You cannot authenticate an address like yourname@gmail.com or @yahoo.com or @outlook.com — you don't control those domains' DNS, so there are no records to add. To send marketing email that reaches the inbox, use a domain you own (like hello@yourcompany.com).
What the records look like
You don't need to write these yourself — BlueyEmail generates them — but seeing the shape helps you recognize them in your DNS host. All three are TXT records. The values below are illustrative examples, not your real records.
; SPF — lists servers allowed to send for your domain
yourcompany.com. TXT "v=spf1 include:_spf.blueyemail.com ~all"
; DKIM — publishes the public key that verifies the signature
bluey._domainkey.yourcompany.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq...AB"
; DMARC — sets the policy and where to send reports
_dmarc.yourcompany.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com"Start DMARC gently
A policy of p=none or p=quarantine lets you begin collecting reports and route suspicious mail to spam without risking legitimate messages being rejected. You can tighten to p=reject later, once your reports confirm everything checks out.
Once your domain shows as verified, you've cleared the biggest hurdle to landing in the inbox. The next step for a brand-new domain is to build up its reputation gradually.
Warm up a new sender
Ramp your volume the right way so providers learn to trust you.
Stay out of spam
A practical checklist for keeping your emails in the inbox.
Still stuck? Our team is happy to help.
Contact support