A complete guide to configuring email authentication for your sending domain — so your bulk emails reach the inbox, not the spam folder.
When you send marketing emails through your own SMTP mailbox, Gmail, Outlook, Apple Mail, and every major email provider check three DNS records on your sending domain to decide whether the message is legitimate. Without these records — or with them set up incorrectly — your emails are very likely to land in spam, or be rejected outright.
Names the mail servers authorized to send on behalf of your domain.
Cryptographically signs each message so receivers can verify it was not tampered with in transit.
Tells receivers what to do when SPF or DKIM fail — quarantine, reject, or just report.
SPF is a single TXT record on your sending domain. It authorizes specific mail servers — your email provider us — to send messages from your domain.
v=spf1 include:_spf.mail.hostinger.com ~all
v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.protection.outlook.com ~all
Only ONE SPF record per domain. If you already have one, merge the new include into it rather than adding a second record.
DKIM publishes a public key in DNS so recipients can cryptographically verify each message was signed by your mail server private key. You enable DKIM at your email provider, then add the CNAME or TXT record they generate to your DNS.
hostingermail1
DMARC ties SPF and DKIM together and tells receivers what to do with messages that fail authentication. Always start in monitoring mode and tighten gradually as you confirm legitimate mail is passing.
Record name: _dmarc.yourdomain.com
v=DMARC1; p=none; rua=mailto:[email protected]
Run this for 2 to 4 weeks. No mail is blocked — you just collect aggregate reports at the rua address.
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]
25% of failing mail is sent to spam. Raise pct gradually to 50, then 100.
v=DMARC1; p=reject; rua=mailto:[email protected]
Failing mail is rejected outright. Strongest protection against spoofing of your domain.
DNS changes can take 1 to 24 hours to propagate. Use these free tools to confirm your records are visible globally before launching a campaign.
Comprehensive SPF, DKIM, DMARC, and MX lookups all in one place.
Verify DNS propagation across 30+ global servers.
Send a test email and get a 1 to 10 deliverability score with detailed feedback.
Built-in pre-flight check. Credible Documents Bulk Email automatically checks your domain MX, SPF, DKIM, and DMARC records before every campaign — and warns you if anything is missing or misconfigured. No need to manually verify each time.
Only one TXT record starting with v=spf1 is allowed per domain. If you see more than one, merge their include: directives into a single record.
DNS changes can take up to 24 hours to propagate worldwide. Use dnschecker.org to confirm the record is visible from multiple regions before launching a campaign.
Start with p=none for at least 2 to 4 weeks. Only tighten to p=quarantine or p=reject once you have reviewed DMARC reports and confirmed legitimate mail is passing.
The domain in your campaign From address must match the domain where your SPF/DKIM/DMARC records live. Sending from [email protected] requires the records on example.com.
Email us your sending domain and we will inspect your DNS for you — no charge for active Bulk Email customers.