Introduction

For emails technical setup is the foundation, but your behavior determines your reputation.

• Contents:
  – Prerequisites
• – Reputation and Deliverability
  – SPF Record
  – DKIM Record
  – DMARC Record
  – BIMI Record
• – DNS Validation and Verification Tools
  – Email Health and Reputation Monitoring

Prerequisites

To update the records, you will need access to the DNS management panel (e.g., Cloudflare, Route53, etc.)

Reputation and Deliverability

If you’re sending business emails, newsletters, or transactional alerts, you’ve likely noticed that “sending” an email doesn’t guarantee it will be “delivered.” With the recent updates from Google and Yahoo, the bar for email reputation has shifted. Think of these as your digital passport, without them, receiving servers view your email as “unverified” and are more likely to flag it as spam.

Maintain a “clean” sender reputation with the following steps:

Prune Your List

Sending emails to dead addresses or “spam traps” kills your reputation. Use a verification tool to remove invalid emails before you hit send.

The “One-Click” Unsubscribe

Make it incredibly easy for people to leave. If a user can’t find the unsubscribe link, they will hit the “Report Spam” button instead. One “Spam” report is worth a thousand “Unsubscribes” in the eyes of Gmail.

Warm Up Your IP:

If you are using a new sending IP, don’t send 10,000 emails on day one. Start small and gradually increase volume to show providers you are a legitimate sender.

SPF Record

SPF stands for Sender Policy Framework, this is a DNS record that lists exactly which IP addresses and services (e.g., Google Workspace, SendGrid, Mailchimp) are authorized to send email on behalf of your domain. If an email comes from a server not on the list, it’s a red flag.

Example

Type: TXT
Host/Name: @ (or leave blank / root)
value:

v=spf1 include:_spf.google.com ~all

Example value variation record, combines the use of both Google and Mailchimp:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

DKIM Record

DKIM stands for DomainKeys Identified Mail, while SPF says who can send, DKIM proves the email wasn’t tampered with in transit. It adds a cryptographic signature to your email headers, ensuring the content is authentic.

Example

Type: TXT
Host/Name: google._domainkey (the selector google is provided by your mail service)
value:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG...[long string of random characters]...

DMARC Record

DMARC stands for Domain-based Message Authentication, reporting, and Conformance and is the “instruction manual” for the receiver. It tells them what to do if SPF or DKIM fails. Do you want the email to be quarantined, or reject entirely, or delivered anyway? A strong DMARC policy is mandatory for bulk senders.

Example

Type: TXT
Host/Name: _dmarc
value:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

BIMI Record

BIMI stands for Brand Indicators for Message Identification and is for email branding. It allows your company logo to appear next to you email in the inbox, even for people who haven’t added you to their contacts.

BIMI Requirements are Strict

BIMI is much harder to set up than the others because it has strict requirements:

DMARC must be “Enforced”:

Your DMARC policy must be set to either p=quarantine or p=reject. If it is set to p=none, then BIMI will be ignored.

SVG Tiny PS Format:

Your logo cannot be a JPG or PNG. It must be a specific type of SVG (Scalable Vector Graphic) called SVG Tiny P.

VMC (Verified Mark Certificate):

To show your logo in Gmail, you generally need a VMC. This is a digital certificate (issued by a CA like DigiCert) that proves you own the trademark to the logo. Without a VMC, some providers will show the logo, but most major ones (like Google) require it.

Example

Type: TXT
Host/Name: default._bimi
value:

v=BIMI1; loc=https://example.com/logo.svg; boot=https://example.com/vmc.pem

DNS Validation and Verification Tools

These tools are used before you start sending to ensure your SPF, DKIM, DMARC, and BIMI records are formatted correctly and are “visible” to the world.

1. MXToolbox (The Gold Standard): The most popular tool for checking DNS records. It has a specific “SuperTool” that lets you run a “Domain Health” check to see if your SPF and DKIM are valid.
2. DMARCian / Postmark DMARC: These are specialized in DMARC. They help you visualize the XML reports you get from Google/Microsoft and tell you if your records are configured correctly.
3. Mail-Tester.com: This is a “live” test. It gives you a unique email address to send a test mail to; it then analyzes that specific email and tells you exactly which DNS records failed and why your “spam score” is high.
4. Kutools / DNSChecker.org: Useful for verifying that your DNS changes have propagated globally (since DNS updates can take a few hours to reach every server).

Email Health and Reputation Monitoring

These tools track how the “big” providers (Gmail, Outlook, Yahoo) perceive your domain over time.

1. Google Postmaster Tools (GPT): Essential for anyone sending to Gmail. It shows you your IP Reputation and Domain Reputation (Low, Medium, High) and tracks your spam rate. If your spam rate exceeds 0.3%, Gmail may start throttling your mail.
2. SenderScore.org (Validity): A long-standing industry tool that gives your IP a “credit score” from 0 to 100. A low score usually means you’ve been flagged for spamming.
3. Talos Intelligence (Cisco): A massive database used to check if your IP address has been “blacklisted.” If you are on a Talos blacklist, your emails will likely be rejected immediately.
4. SNDS (Microsoft Smart Network Data Service): The equivalent of Postmaster Tools for Outlook, Hotmail, and Live.com. It provides data on the volume of mail you send and the number of complaints.

List Validation (The “Cleanliness” Tools)

To keep your health high, you need to remove “dead” emails before you send. These tools “ping” the email server without actually sending a message to see if the account exists.

1. ZeroBounce / NeverBounce: These are the leaders in list cleaning. They scan your CSV list and mark emails as Valid, Invalid, or Unknown.
2. Kickbox: Great for integrating directly into your sign-up forms to prevent “fake” emails from ever entering your database.