SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are authentication technologies that verify whether an email's sending domain is legitimate. Both are configured via DNS records and help prevent email spoofing.
SPF works by declaring in a DNS TXT record: "only these IP addresses are authorized to send email from this domain." The receiving server checks whether the sender's IP address is listed in that record, but the outcome is not a simple pass or fail. RFC 7208 defines seven results: pass, fail, softfail, neutral, none, temperror and permerror. A fail is an explicit statement by the domain owner that the sending host is not authorized to use the domain, and what the receiver does with that message is left to its own policy. A pass, conversely, says only that the host was authorized to use the domain; it is not evidence that the message itself is safe.
DKIM attaches a digital signature to emails. The sending server computes two hashes, one over the message body and one over the header fields it chooses to sign, then signs them with a private key. The public key is published as a TXT record at a name of the form selector._domainkey.example.com, which the receiving server fetches to verify the signature. What a valid signature establishes is that the signed portion of the message has not changed since it was signed, and that the signing domain has taken some responsibility for the message. RFC 6376 is explicit that it asserts nothing beyond that about the message.
For email marketing containing shortened URLs, SPF and DKIM configuration is especially important. A shortened link hides the destination domain, so recipients cannot judge the message from the link text alone, and authenticating the sending domain is one way for the sender to make up for that gap. It is worth being clear about the limit, though: SPF and DKIM verify the sending domain, not the destination of the shortened URLs inside the body. An authenticated message can still carry a dangerous link, so recipients still need the habit of checking where a link leads. On deliverability, Google states that since February 1, 2024 every sender to Gmail accounts must set up either SPF or DKIM, and that mail which does not meet the requirements might not be delivered as expected, or might be marked as spam.
In addition to SPF and DKIM, DMARC (Domain-based Message Authentication, Reporting and Conformance) lets you ask receivers how to handle mail that fails authentication. The policy takes one of three values: none (request no specific action), quarantine (treat the mail as suspicious) and reject (reject it). All three are requests, and RFC 7489 notes that final disposition is always a matter of local policy. The step that trips people up is identifier alignment: even when SPF or DKIM passes, DMARC only passes if the authenticated domain aligns with the domain in the From header that recipients see. Sending through a delivery service under its default domain is how you end up with SPF and DKIM succeeding while DMARC alone fails. For senders of more than 5,000 messages per day to personal Gmail accounts, Google requires both SPF and DKIM plus a DMARC record, whose enforcement policy may be set to none.