Inventory every sender, publish one maintainable SPF policy, sign with aligned DKIM, collect DMARC reports at a monitoring policy, fix legitimate failures, then increase enforcement deliberately. Authentication is a foundation, not an inbox-placement guarantee.
The three protocols in plain language
| Protocol | What it proves | What it does not prove |
|---|---|---|
| SPF | The connecting sender is authorized by the envelope-return domain | That the visible From domain authorized the message unless alignment also holds |
| DKIM | A domain signed selected message content and headers | That the visible From domain matches unless alignment also holds |
| DMARC | At least one authenticated domain aligns with the visible From domain, then applies policy and reporting | That recipients wanted the message or that it belongs in the inbox |
Alignment is the part most summaries skip
A message can pass SPF for a provider-owned return path or DKIM for a provider-owned signing domain while showing your domain in From. DMARC asks whether the organizational domain used by a passing SPF or DKIM identity aligns with that visible From domain. That connection is what lets a domain owner publish a meaningful policy. [3][2]
For direct mail to personal Gmail accounts, Google requires bulk senders to align the From domain with either SPF or DKIM and recommends alignment through both. Configure custom return paths and DKIM domains where the sending provider supports them. [1][2]
A safe rollout order
- Inventory every legitimate system that sends with the domain.
- Remove obsolete senders and consolidate the SPF policy.
- Enable DKIM for each active sender, preferably with independently rotatable selectors.
- Publish DMARC in monitoring mode and route aggregate reports to a system that can parse them.
- Fix or retire legitimate paths that fail authentication or alignment.
- Move toward quarantine or reject only after reviewing evidence and covering forgotten senders.
- Rotate DKIM keys with an overlap window so delayed mail can still verify.
Common mistakes
Publishing two SPF records is not a redundancy strategy. Neither is adding every historical provider forever. SPF has DNS lookup constraints, forwarding can break it, and an overly broad policy authorizes more infrastructure than intended.
Other frequent failures include using provider-default DKIM without alignment, never reading DMARC reports, rotating a selector by deleting the old key immediately, placing DMARC at the wrong label, and assuming a green DNS checker proves real messages align.
What an AI agent should and should not do
An agent can inventory providers, explain reports, detect drift, prepare proposed records, and flag an unknown sender. It should not publish a destructive DMARC policy, remove an SPF include, or rotate a signing key without deterministic validation and accountable approval.
DNS changes should be versioned, limited to the exact zone and record names, verified through public resolvers, and reversible. The agent’s explanation is useful context; the control plane’s read-after-write verification is the evidence.
Common questions
Questions, answered plainly
Do I need SPF, DKIM, and DMARC?
Yes as a modern baseline. Google requires SPF or DKIM for all senders to Gmail and all three for bulk senders; using all three also improves control and reporting.
Does DMARC improve deliverability?
DMARC improves authenticated identity and policy visibility. It does not guarantee placement or compensate for unwanted mail.
Should DMARC start at reject?
Usually begin by observing reports and correcting legitimate traffic, then increase enforcement deliberately. The right path depends on the domain’s complete sending inventory.
Evidence
Sources and methodology
Product capabilities were checked against first-party documentation available on September 9, 2026. Policies, plans, and prices can change; verify them before buying. General guidance is educational and is not legal advice.
- Email sender guidelines Google. Authentication, DNS, spam-rate, formatting, unsubscribe, and volume guidance for Gmail.
- Email sender guidelines FAQ Google. Bulk-sender definitions and DMARC alignment details.
- DMARC overview DMARC.org. How DMARC builds on SPF and DKIM to add alignment, policy, and reporting.
Your agent can do the thinking.
The infrastructure still needs a grown-up.