Authenticate your domain (SPF, DKIM, DMARC)
Reviewed by Eran Betzalel, founder · 2026-09-30
Authenticating your domain means adding three kinds of DNS records, SPF, DKIM, and DMARC, that prove to mailbox providers your campaigns really come from you. It is the single most important deliverability step you can take, and Boostmail requires a verified sender domain before you send. Boostmail generates the exact records for your domain; you add them at your DNS host and Boostmail shows the status of each one.
What each record does
- SPF (Sender Policy Framework) publishes which servers are permitted to send email for your domain. Receivers check it to reject forged “from” addresses.
- DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message. The receiver verifies the signature to confirm the email wasn’t altered in transit and genuinely originated from your domain.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together. It tells inbox providers how to handle mail that fails authentication and can send you reports on who is mailing as your domain.
Together, these three turn an unverified sender into a trusted one, and since February 2024 Google and Yahoo require them from bulk senders.
Use a branded sending domain
You can only authenticate a domain you control, so send from something like hello@yourstore.com, not a free mailbox address such as gmail.com or yahoo.com. Free-mailbox sending can’t publish these records and is treated with suspicion by receivers.
Add and verify the records
In Boostmail, open Account, go to the Domains tab, enter your sender address, and click Verify. Boostmail then lists the SPF, DKIM, and DMARC records for your domain. In your DNS provider (your registrar or DNS service), add each record exactly as shown, a wrong record type, host name, or a stray space is the most common cause of failures. The suggested DMARC record uses a monitoring policy (p=none), which is a sensible starting point.
Back in Boostmail, each record shows its own status. DNS changes propagate anywhere from a few minutes to a few hours, so check again if a record isn’t verified right away. Once the domain is verified, you can send from your address.
After authentication
Authentication gets you to the inbox; staying there depends on how you send. Continue with improve your sender reputation, and learn more about Boostmail’s deliverability features. If verification won’t pass, email support@boostmail.app.
- 1
Open your domain settings in Boostmail
In Boostmail, go to Account and open the Domains tab. Enter the sender address you want to send from, on a domain you own, such as hello@yourstore.com. Free mailbox addresses like gmail.com or yahoo.com can't be used, because you can't publish DNS records for those domains.
- 2
Start verification
Click Verify and confirm. Boostmail then shows the exact SPF, DKIM, and DMARC records for your domain, each with its own status. Keep this screen open, you'll copy these values into your DNS provider.
- 3
Add the SPF records
In your DNS host (the registrar or service that manages your domain's DNS, such as GoDaddy or Cloudflare), add the SPF records Boostmail lists. SPF tells receivers which servers are allowed to send mail for your domain so they can reject forgeries.
- 4
Add the DKIM records
Add each DKIM record exactly as shown. DKIM adds a cryptographic signature to every message so receivers can confirm it wasn't altered and really came from your domain.
- 5
Add the DMARC record
Add the DMARC TXT record at _dmarc.yourdomain. DMARC tells inbox providers what to do with mail that fails SPF or DKIM. Boostmail's suggested record uses a monitoring policy (p=none), a safe starting point before you consider tightening it.
- 6
Check the status in Boostmail
Return to the Domains tab and check the status next to each record. DNS changes can take anywhere from a few minutes to a few hours to propagate, so if a record isn't verified yet, wait and check again. Once your domain is verified, you can send from your address.
Frequently asked questions
- What's the difference between SPF, DKIM, and DMARC?
- SPF lists which servers may send mail for your domain. DKIM cryptographically signs each message so receivers can verify it wasn't tampered with. DMARC ties the two together, telling inbox providers how to handle mail that fails and optionally sending you reports. Together they prove your mail is genuinely from you.
- Do I really need all three?
- Yes. Since February 2024, Google and Yahoo require bulk senders to authenticate their domains, and unauthenticated mail is far more likely to land in spam or be blocked. Boostmail requires a verified sender domain for this reason.
- Why won't a gmail.com or yahoo.com address work?
- You can only authenticate a domain you control. Sending from a free mailbox address means you can't publish SPF, DKIM, or DMARC for that domain, and providers treat such mail with suspicion. Use a branded domain like yourstore.com.
- It's not verifying, what should I do?
- DNS changes can take from a few minutes up to a day to propagate. Double-check that each record was added exactly as shown (correct type, name, and value, with no extra spaces), wait a while, and check the Domains tab again. If it still fails, email support@boostmail.app for help.