You’ve written the perfect email campaign, hit send, and watched it land in spam folders across half your list. The content wasn’t the problem. Your DNS setup was.
Email marketing platforms need your domain to prove it actually belongs to you and has approved the email being sent. That proof lives entirely in a handful of DNS records most people never think to check.
Why This Step Can’t Be Skipped
Without proper authentication, mailbox providers like Gmail and Outlook have no reliable way to confirm your marketing emails are legitimate. The practical result is lower deliverability, campaigns landing in spam, and, in some cases, emails getting rejected outright.
Three DNS records work together to fix this: SPF, DKIM, and DMARC.
SPF: Saying Who’s Allowed to Send on Your Behalf
SPF is a TXT record that lists which mail servers are authorized to send email using your domain name.
If you’re using a tool like Mailchimp, this usually means adding the platform’s sending servers to your existing SPF record, not replacing it. A domain can only have one SPF record, so if you already send email through other services, combine everything into a single record rather than creating a second one.
Two separate SPF TXT records on the same domain will break authentication for all of them, not just the new one.
DKIM: Proving the Email Wasn’t Altered
DKIM works differently from SPF. Instead of listing approved servers, it attaches a digital signature to each email that proves the message came from your domain and wasn’t changed in transit.
For most email marketing platforms, setting this up means adding two CNAME records to your DNS, exactly as the platform provides them. These records point back to the platform’s signing infrastructure.
For standard marketing campaigns sent through tools like Mailchimp, DKIM is typically the record doing the real authentication work, even more so than SPF.
DMARC: Telling Mailbox Providers What to Do With Failures
DMARC is a TXT record that tells receiving mail servers how to handle messages that fail SPF or DKIM checks, and it gives you visibility into who’s sending email using your domain.
A domain can only have one DMARC record. Publishing two by accident, often because an old one was never removed, makes the entire DMARC setup invalid.
Setting This Up Step by Step
- Log in to your email marketing platform and find its domain authentication or sending domain settings.
- Copy the exact DKIM CNAME records the platform provides
- Log in to your DNS management panel and add those CNAME records exactly as given.
- Check your existing SPF TXT record. If one already exists, add the platform’s required include value to it rather than creating a new record.
- Add or update your DMARC TXT record, making sure only one exists.
- Return to your email platform and run its domain verification or test tool to confirm everything is recognized correctly.
Give DNS Changes Time to Spread
DNS updates don’t apply instantly everywhere. Changes can take anywhere from a few minutes up to 48 hours to fully propagate, depending on your DNS provider and record settings.
If verification fails immediately after adding records, wait a while before assuming something’s wrong. Check again after a few hours.
Double-Check With a Real Test Email
Once your platform shows everything as verified, send yourself a real test campaign and check the message headers in Gmail or Outlook to confirm SPF, DKIM, and DMARC are all actually passing, not just configured.
Getting the Records in the Right Place
All of this depends on having full, easy access to your domain’s DNS settings, which isn’t always guaranteed depending on where your domain is managed.
HoganHost’s free DNS management gives you direct control to add and edit exactly these kinds of records, so your email marketing platform’s authentication requirements can be set up correctly the first time.
