SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are authentication technologies that verify whether an email's sending domain is legitimate. Both are configured via DNS records and help prevent email spoofing.
SPF works by declaring in DNS: "only these IP addresses are authorized to send email from this domain." The receiving server checks whether the sender's IP address is listed in the SPF record; if not, the email is flagged as potentially fraudulent.
DKIM attaches a digital signature to emails. The sending server computes a hash of the email's headers and body, then signs it with a private key. The receiving server verifies the signature using the public key published in DNS, confirming the email has not been tampered with.
For email marketing containing shortened URLs, SPF and DKIM configuration is especially important. As cases of shortened URLs being exploited for phishing increase, proving sender legitimacy through SPF/DKIM is essential for earning recipient trust. Emails without SPF/DKIM are far more likely to be caught by spam filters in Gmail and Outlook.
In addition to SPF and DKIM, configuring DMARC (Domain-based Message Authentication, Reporting and Conformance) lets you specify how to handle emails that fail authentication (reject, quarantine, or allow). Google mandated SPF/DKIM/DMARC for domains sending more than 5,000 emails per day starting February 2024. You can find related books on Amazon.