Email Deliverability: SPF, DKIM, DMARC (the right way)

Most developers avoid touching DNS. For good reason—it's easy to break.

But email deliverability depends on it. SPF, DKIM, DMARC. Get it wrong, your emails land in spam.

Here's the minimal knowledge you need.

What These Do (Very Simple Version)

SPF (Sender Policy Framework): "I authorize these servers to send email from my domain"

DKIM (DomainKeys Identified Mail): "Every email from my domain is cryptographically signed"

DMARC (Domain-based Message Authentication): "If SPF or DKIM fails, here's what to do (reject, quarantine, or report)"

Without these, mailbox providers assume your emails are suspicious.

What You Actually Set Up

There's no way around editing DNS—every provider needs records under your domain, because that's the whole point: you're proving the domain is yours.

What a provider can do is generate the records for you, so you're copying values rather than inventing them. That's what Tratto does. You add your domain in the dashboard (or via POST /v1/domains) and get back the records to paste at your DNS provider—GoDaddy, Namecheap, Cloudflare, Route 53, wherever your zone lives.

Five records, of which three are mandatory:

1. Three DKIM CNAME records (required). Tratto uses Amazon SES, which manages the signing keys; you publish three CNAMEs with tokens unique to your domain, and SES handles the key material behind them. There's nothing for you to generate and nothing to paste from a private key.
2. One SPF TXT record (recommended): v=spf1 include:amazonses.com ~all. If your domain already has an SPF record, merge the include into the existing one—a domain must never publish two SPF records.
3. One DMARC TXT record (recommended): something like v=DMARC1; p=quarantine; rua=mailto:[email protected].

Two honest notes on that list.

SPF and DMARC are recommendations, not gates. Tratto verifies the DKIM CNAMEs, because those are what SES needs in order to sign. It does not check whether you published SPF or DMARC, and it will happily send without them. They're still worth adding—they're most of what separates "authenticated" from "merely signed"—but nobody is going to nag you.

rua reports go wherever you point them. The DMARC record above sends aggregate reports to an address you control. Tratto doesn't ingest DMARC reports and doesn't alert on them. If you want that, point rua at one of the DMARC analytics services, or at a mailbox you'll actually read.

Verification

Once the records are published, verification is a poll: a background job re-checks every pending domain every 10 minutes. If you don't want to wait for the next tick, POST /v1/domains/{id}/verify checks immediately.

The slow part isn't the poll, it's DNS itself. SES looks for the records for up to 72 hours, and propagation genuinely can take hours depending on your registrar's TTL. Publish the records, hit verify once, and check back—don't sit refreshing.

The full procedure, with the API calls and the response shapes, is in the domain setup documentation.

Maintenance

Very little, which is the point.

SES manages the DKIM keys behind the three CNAMEs you published, so there is no key rotation for you to schedule—and, to be equally clear, no rotation feature that Tratto performs on your behalf either. The CNAMEs stay put.

What does need your attention:

• Don't delete the records when you're cleaning up DNS. Removing the DKIM CNAMEs silently un-verifies the domain.
• If you add another sending service (a helpdesk, a CRM, an invoicing tool), you have to merge its include into your single SPF record yourself. Nothing does this for you.
• If you tighten DMARC from p=quarantine to p=reject, do it after you've watched reports for a while, not on day one.

The Truth About Spam Folders

Even perfect SPF/DKIM/DMARC won't guarantee inbox placement. Authentication gets you considered, not delivered. Mailbox providers also weigh:

• Sending volume—sudden spikes look suspicious
• Content—links, attachments, certain keywords
• User engagement—do recipients open your emails?
• Complaint rate—do recipients mark you as spam?

No provider can fix bad content or a cold list. What infrastructure can do is make sure the good emails aren't rejected for a reason that was avoidable.

If You're Starting From Zero

1. Add your domain in the dashboard.
2. Copy the three DKIM CNAMEs into DNS. Add SPF and DMARC while you're in there—you're already in the zone editor.
3. Hit verify, then wait for the 10-minute poll if it doesn't pass immediately.
4. Send to yourself first. Check the raw headers for dkim=pass and spf=pass.
5. Start small. A few hundred a day beats a cold blast of fifty thousand.

---

Email reputation is like a credit score—takes time to build, easy to destroy, impossible to recover fast once broken.

Join the beta and send emails with confidence.