SPF, DKIM, DMARC and BIMI Setup

The rules mailbox providers now enforce

Before a buyer ever sees your email, Gmail, Yahoo and Outlook run it through a series of checks, and in 2024 those checks got stricter. We handle SPF, DKIM and DMARC setup for Los Angeles businesses, configuring the records behind email campaigns that reach the inbox, then testing delivery to all three providers.

Gmail applies its sender guidelines to every sender, with stricter bulk-sender rules for domains that send 5,000 or more messages a day to Gmail addresses; they took effect on 1 February 2024. Yahoo began enforcing its standards the same month. Outlook.com, Hotmail and Live added requirements for high-volume senders in 2025, and mail from a domain that fails them is rejected.

Three records carry most of the weight. SPF lists the servers allowed to send for your domain. DKIM signs each message with a key published in your DNS, so the receiver can confirm the message was not altered. DMARC tells the receiver what to do when a message fails both, and where to send reports.

Every service that sends in your name, whether your CRM, your store, your newsletter tool or your helpdesk, needs its own place in these records. The alignment between the visible From domain and the authenticated domain decides whether the message passes.

IN-HOUSE ADVANTAGE

Connected With Our Full Los Angeles Team

Our developers set up SPF, DKIM and DMARC for every service that sends mail in your name.

What Is Included in Email Authentication

Your Email Authentication Process

DiscoveryWe review your setup, audience and goals, and you receive a clear scope before work starts.
DesignChannels, keywords and tracking are planned with you.
BuildCampaigns, tracking and pages are built by our in-house team with no handoffs.
LaunchChanges go live with your approval.
SupportThe team that built it stays available after launch.

SPF and DKIM, then a DMARC policy you can enforce

Close-up of a hand pointing at a laptop screen of abstract lines.

The first step is finding every system that sends mail as your domain, because a forgotten tool fails silently once enforcement begins. SPF is published within the protocol's limit of ten DNS lookups, and DKIM keys are generated per sender at 2048 bits where the provider supports it.

DMARC begins at a monitoring policy with reporting enabled. We read the reports for the volume and sources they show, fix the failures, then move the policy to quarantine and finally to reject once legitimate mail passes. Pace matters: moving too fast drops real mail, and waiting too long leaves the domain open to spoofing.

Your Mailchimp email marketing account, or any other platform you use, is configured with its own signing domain, which brings its mail into alignment with the rest of your domain.

An IT lead lists every system that sends mail on a whiteboard with a colleague.

Unsubscribe headers and complaint rate

Marketing and subscribed messages must support one-click unsubscribe, which means a List-Unsubscribe header and a List-Unsubscribe-Post header following RFC 8058, plus a visible unsubscribe link in the body. Yahoo says requests should be honored within two days.

Gmail and Yahoo both watch the share of recipients who mark you as spam and publish thresholds for it. We set up Google Postmaster Tools for your domain and read its figures alongside list hygiene: confirmed sign-ups, suppression of bounces and non-responders, and a sending rhythm your list expects.

When a sending address or IP is already blocked, getting off an email blacklist is a separate recovery job. Our team handles that as well, and the records set up here reduce the chance of a repeat.

BIMI and the verified logo

A marketer checks an unsubscribe link on a phone, satisfied.

BIMI shows your logo beside your messages in inboxes that support it, a small mark of trust at the moment someone decides whether to open. Because it rests on authentication, it comes last.

Gmail requires a DMARC policy of quarantine or reject at full enforcement, a logo supplied as an SVG Tiny Portable/Secure file, and a Verified Mark Certificate or a Common Mark Certificate issued by a certificate authority. The VMC adds Gmail's verified checkmark and the CMC does not.

We prepare the SVG file, advise which certificate your trademark status allows, publish the BIMI record and then test how the logo displays in the inbox.

Monitoring and the systems around it

Authentication drifts when a new tool starts sending or someone edits a DNS record. DMARC reports reveal both, so we monitor them, alert you whenever an unauthorized source appears and review the results with you regularly.

Your mailbox hosting and DNS belong with your website. Our managed website and email hosting and server maintenance services keep the records current, and website maintenance and hosting treats DNS as part of the site.

A CRM or form tool that sends on your behalf is wired in through connecting your CRM to marketing, while consent-based text message marketing runs as a separate channel with rules of its own. Spoofing protection is also part of web application security, and every campaign in your online marketing depends on mail that arrives.

All Online Marketing

Email Authentication Questions & Answers

What does DMARC do?

DMARC tells a receiving server what to do with mail that claims to come from your domain but fails authentication: deliver it, quarantine it or reject it. Its reports also show who is sending as your domain, which brings forgotten tools and spoofing attempts into view.

Do I need BIMI?

No. BIMI is optional and builds on DMARC enforcement. It suits brands that want their logo in the inbox and are ready to run a quarantine or reject policy. Authentication comes first either way.

What counts as a bulk sender?

Google defines a bulk sender as one that sends 5,000 or more messages a day to Gmail addresses. Microsoft uses 5,000 or more messages to its consumer services from one domain. Smaller senders still need SPF or DKIM and benefit from all three records.

Why do emails fail even with correct records?

Records can be correct and still misaligned, because the visible From domain must match the SPF or DKIM domain. Other causes include a high spam complaint rate, a missing unsubscribe header, a weak list or a blocked sending IP. We test a live message and read its headers to find the cause.

How do you monitor DMARC reports?

Mailbox providers send DMARC aggregate reports as XML to the address in your record. We route them to a parser that groups results by sending source and flags any source missing from your approved list, turning raw files into a readable summary.

Tell Us About Your Project.

Speak directly with our Los Angeles online marketing specialists, or share your project details.

Direct Los Angeles Office 323-540-4370

Call Us

Zero obligation or sales pressure

Email Authentication: SPF, DKIM, DMARC and BIMI