Guides
SPF, DKIM, and DMARC rollout for a US newsletter: stages and timing
A staged rollout plan for SPF, DKIM, and DMARC on a US newsletter domain: what to publish first, how long each stage takes, and where it stalls.
What to take away
- SPF, DKIM, and DMARC are DNS records that tell US mailbox providers your newsletter is authorized to send from your domain.
- Gmail and Yahoo require SPF and DKIM from bulk senders, and their high-volume rules apply once you cross their daily volume limit.
- Alignment is the testthe domain in the From header must match the domain authenticated by SPF or DKIM.
- Roll out in stages and watch DMARC reports before moving to enforcement.
The setup starts with SPF, DKIM, and DMARC in the DNS zone for the domain you use in your From address. If you send from a free webmail address, you cannot satisfy the Gmail and Yahoo rules. The work below assumes you control that domain.
The short version
Publish SPF first, then DKIM, then DMARC in monitoring mode. SPF can be done in one business day after you gather your sending IPs. DKIM usually takes one to two business days to generate and publish the key. DMARC monitoring starts with a single TXT record and takes two to three business days to publish, but meaningful reports need about seven days to accumulate. After two to three weeks of clean reports, move DMARC to quarantine or reject. Before any of this, verify that your email service provider supports custom DKIM signing and lets you see the DNS records. If paid subscriptions are involved, review the subscription tax guide before collecting payment.
Rollout Order and Durations
- SPF record1 business day
- DKIM key1-2 business days
- DMARC monitor2-3 days to publish
- First DMARC reportsabout 7 days
- DMARC enforce2-3 weeks after clean reports
Stage by stage
| Stage | Typical duration | What has to be true first |
|---|---|---|
| SPF record | 1 business day | You have a list of every IP address or range your provider sends from. |
| DKIM key | 1-2 business days | Your provider has issued a selector and public key for your domain. |
| DMARC monitor | 2-3 business days to publish, 7 days for first reports | SPF or DKIM passes for your normal campaigns. |
| DMARC enforce | 2-3 weeks after clean reports | Alignment is at least 95 percent for legitimate mail. |
The DNS zone is the blocker. Without access to change TXT records, none of this can start.
Prerequisites Before Each Stage
- DNS edit access for the From domain
- Full sending IP list before SPF
- Provider selector and public key before DKIM
- 95 percent alignment before DMARC enforcement
What has to exist before what
- Domain control for the From domain is the first blocker. If you cannot edit DNS, stop and get credentials.
- Before SPF, you need the full list of sending IP addresses from your provider. Guessing them produces a record that fails.
- Before DKIM, the provider must give you a selector and a public key. The selector names the key in DNS, and the key must match what the provider signs.
- Before DMARC enforcement, SPF or DKIM must pass for at least 95 percent of your legitimate mail. Otherwise you will quarantine your own list.
What the records actually look like
Publish each of these as a TXT record. The values are placeholders: swap example.com for the domain in your From header and keep the record names exactly as shown.
- SPF, on the root domain
v=spf1 include:_spf.yourprovider.com include:spf.yoursecondprovider.com -all. Use~allin place of-allwhile you are still testing;-alltells receivers to reject anything not authorized by the record. - DKIM, at
selector1._domainkey.example.comv=DKIM1; k=rsa; p=<the public key from your provider>. The selector and the key come from your email service provider, and you paste the key exactly as issued. - DMARC, at
_dmarc.example.comv=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensics@example.com. Thep=nonetag only collects reports,p=quarantinesends failing mail to the spam folder, andp=rejectblocks it. Theruaaddress receives aggregate reports andrufreceives forensic samples.
Providers, tools, and the bulk-sender line
Gmail draws its line at volume: senders who send more than 5,000 messages per day to Gmail accounts have to follow its requirements for high-volume senders, so finish the rollout before a list grows into that band.
Choose an email service provider that signs with your domain rather than its own. Mailchimp, Kit, MailerLite, and Campaign Monitor all let you publish your own selector and key, which is what makes alignment possible. A provider that signs only with a shared domain leaves you stuck at the first stage.
Aggregate reports arrive as XML attachments and are unreadable by hand. Analyzers such as dmarcian, Valimail, EasyDMARC, and URIports turn them into a table of which sources pass and which fail.
Before you send a commercial campaign, verify the CAN-SPAM duties that live outside DNS: a working unsubscribe mechanism, a valid physical postal address in the message, accurate From, Subject and routing information, and a process that honors opt-outs. Authentication does not replace any of them, so work through the CAN-SPAM compliance checklist before the first send.
Where it stalls
The most common stall is a DMARC report that shows high alignment but still poor placement. Cause: the Return-Path domain and the From domain are different. Some platforms sign mail with their own domain while your From header uses yours. That fails alignment for Gmail and Yahoo. Another stall is SPF permerror. Cause: the SPF chain exceeds ten DNS lookups, often after you add a third-party platform or several include statements. A third stall is DKIM body hash mismatch, caused by a mailing list or forwarder that edits the subject line after signing.
Before you add a new sender, check whether it will use its own DKIM signing. If it does, the From domain will no longer align unless the provider changes its setup.
Sponsor marketplaces can add sender domains that break alignment. Check the newsletter sponsor marketplaces comparison before you sign.
What to do while waiting
While the DMARC monitor collects reports, use the time to harden the rest of the sending stack. Do not tighten DMARC until you see at least one week of aggregate reports with no failures on your normal campaigns.
- Confirm SPF record includes all sending IPs and no extra lookups.
- Confirm DKIM selector and key are published and a test message verifies.
- Confirm the DMARC record sits at
_dmarcwithp=noneand aruaaddress you actually monitor. - Confirm DMARC report mailbox receives daily aggregate reports.
- Check that the From domain and Return-Path domain match for your regular campaigns.
- Record any third-party sender used for a one-off campaign.
Confirm your provider signs DKIM with your domain, not a shared domain. A shared domain can pass DKIM for itself but fails DMARC alignment when the From header is yours.
Review any subdomains used for tracking or reply addresses. Each one needs its own SPF or DKIM if it appears in the From header. This prevents a quiet failure where one subdomain passes SPF but the visible From domain does not.
While reports accumulate, review sponsored issue rules if you run paid placements. See the FTC disclosure rules guide before a sponsored issue.
