Why it matters
Since 2024, Gmail and Yahoo require every sender to authenticate the domain with SPF or DKIM. Bulk senders (more than 5,000 messages a day to Gmail accounts) need all three: SPF, DKIM and DMARC.
Beyond delivery, these records protect your brand: they make it harder for anyone to send fake email in your domain's name.
SPF: who may send for your domain
SPF is a TXT record listing the servers allowed to send for the domain. Each domain name should have a single SPF record; if you use more than one service, merge their includes into one record.
In MepMail, SPF lives on the bounce subdomain (MAIL FROM), which the dashboard creates and shows next to its MX.
DKIM: the signature on every message
DKIM signs each message with a private key; the public key sits in a TXT record in your DNS, and the receiving provider checks the signature.
In MepMail, new domains use a single TXT at mepmail._domainkey, shown in the dashboard when you add the domain.
DMARC: what to do when something fails
DMARC is a TXT at _dmarc.yourdomain.com. It tells providers what to do with messages that pass neither SPF nor DKIM aligned with the sender's domain, and where to send reports.
Start by monitoring, with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, read the reports for a few weeks, then move to p=quarantine and, if you like, p=reject.
How to check
The MepMail dashboard resolves each record live and shows, line by line, what is fine and what is missing, including the DMARC inherited from the parent domain when you send from a subdomain.
To check a delivered message, open the original in Gmail (Show original): spf=pass, dkim=pass and dmarc=pass mean you are all set.