Isolated sending infrastructure
SPF, DKIM and DMARC
Three DNS records that tell the receiving server your mail is really yours.
SPF lists which servers may send for your domain. DKIM signs each message so it cannot be altered in transit. DMARC tells receivers what to do when a message fails the other two, and where to send the report.
Missing or wrong records are the most common reason a well-written email lands in spam. In one engagement a single SPF fix moved a customer domain from a score of 50 to 70 on the same checker, before any warmup.
We start DMARC at monitor-only, read the reports for a few weeks, and only then move to quarantine and reject. Going straight to reject on a domain you have not observed blocks your own mail.
Our open source tool email-intel reads all three records for any domain and grades them. It is the same check we run before we touch a customer domain, and the same reading the first screen of the plan runs on the domain you sell from.
Questions
Does a subdomain need its own records?
Yes. SPF and DKIM are set on the sending subdomain, and DMARC can be set on the subdomain or inherited from the parent policy. We set all three on the subdomain so the outbound layer is fully described on its own.
What score is good enough?
The checker grades from F to A. We do not start warmup below a B, because warmup on a domain with a failing record builds reputation on a foundation that will be pulled out later.
This page is part of outbound engineering, the practice of running B2B outbound as a measured system.
Bring your ideal customer profile. Leave with a plan for the first eight weeks.
Three screens, then thirty minutes with the person who builds the system. If outbound is not worth running for you, you hear that too.
Get your planAlready running outbound? Say so and we start from your deliverability numbers.