SPF, DKIM, DMARC and BIMI Setup for Marketers (2026)

#01How do SPF, DKIM and DMARC fit together?

Alignment is the part marketers miss. If your ESP sends with a Return-Path on bounce.esp.example and signs DKIM with d=esp.example, SPF and DKIM can both "pass" while DMARC fails, because neither matches your From domain news.yourbrand.example. Fix it by setting a custom return-path (bounce domain) and custom DKIM on your domain in the ESP.

#02How do you set up SPF?

1. Inventory every sender: ESP, CRM sequences, support desk, billing, product notifications, Google Workspace or Microsoft 365, outbound tools.
2. Decide subdomains. Put each major sender on its own subdomain where possible. Each subdomain gets its own SPF record, which keeps you under the lookup limit.
3. Write one record per domain. Only one SPF TXT record is allowed per name.

news.ledgerline.example.  TXT  "v=spf1 include:spf.esp-provider.example -all"
ledgerline.example.       TXT  "v=spf1 include:_spf.google.com -all"

1. Count lookups. Each include, a, mx, ptr, exists and redirect costs a lookup, including nested ones. More than ten is a permanent error. Use an SPF checker to count.
2. Choose the ending. -all (fail) or ~all (softfail). With DMARC in place, ~all is common and safe; -all is stricter.

Note: with most ESPs, SPF is checked on the bounce domain, so you add the ESP's include to that custom return-path subdomain, often via a CNAME the ESP gives you.

#03How do you set up DKIM?

1. In each sending tool, find "domain authentication" or "custom DKIM".
2. Publish the records it gives you, usually two CNAMEs (so the vendor can rotate keys) or a TXT with the public key.
3. Use 2048-bit keys where the vendor allows.
4. Verify in the tool, then send a test to a Gmail account and open "Show original": look for DKIM: 'PASS' with domain news.ledgerline.example.
5. Rotate keys at least yearly if you manage them yourself.

#04How do you roll out DMARC?

Step 1: publish monitoring

_dmarc.ledgerline.example.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@ledgerline.example"

Use a DMARC report processor (many offer free tiers) rather than reading XML by hand. Collect at least two to four weeks of reports covering a full monthly cycle of invoices, newsletters and campaigns.

Step 2: fix every legitimate source

For each source in the reports, confirm aligned SPF or DKIM passes. Common culprits: the old CRM, a webinar tool, a survey tool, a billing system, and a sales rep's personal sequencing tool.

Step 3: enforce

_dmarc.ledgerline.example.  TXT  "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:dmarc-reports@ledgerline.example"

Then, after a clean period:

_dmarc.ledgerline.example.  TXT  "v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc-reports@ledgerline.example"

What changed in RFC 9989?

DMARC was republished in May 2026 as RFC 9989, with aggregate reporting in RFC 9990 and failure reporting in RFC 9991, replacing RFC 7489. Practical points for marketers:

• pct, rf and ri are deprecated. Gradual rollout by percentage is no longer part of the standard; move policies in steps instead.
• np= lets you reject mail from subdomains that do not exist.
• Organisational domain discovery uses a DNS tree walk instead of the Public Suffix List. This rarely changes anything for a normal company domain.
• Existing valid records keep working.

#05How do you set up BIMI?

BIMI shows your logo next to your messages in supporting clients such as Gmail, Yahoo and Apple Mail.

1. Enforce DMARC at p=quarantine or p=reject for the organisational domain and the sending subdomain. Google's BIMI help still refers to pct=100; under RFC 9989, omit pct or keep it at 100.
2. Prepare the logo as SVG Tiny Portable/Secure (SVG Tiny PS), square, centred, solid background.
3. Get a certificate for Gmail: a VMC (requires a registered trademark, shows a blue checkmark) or a CMC (no trademark needed, logo shown without a checkmark).
4. Publish the record:

default._bimi.ledgerline.example.  TXT  "v=BIMI1; l=https://ledgerline.example/bimi/logo.svg; a=https://ledgerline.example/bimi/vmc.pem"

1. Wait and check. Display depends on reputation and volume as well as the record.

#06Worked example: Ledgerline

Ledgerline is a fictional accounts-payable software company. Figures are illustrative, not benchmarks.

Ledgerline's root domain has an SPF record with 13 lookups and no DMARC record. Gmail shows "via esp-provider.example" on newsletters.

Walkthrough

1. Inventory: seven senders found, including a forgotten survey tool.
2. Split by subdomain: news. for the ESP, app. for product mail, root for Google Workspace only. Root SPF drops to 4 lookups.
3. Custom DKIM and return-path set up in the ESP and product mail service. "via" disappears.
4. DMARC p=none with a report processor for four weeks. The survey tool fails alignment and is moved to authenticated sending.
5. Quarantine, then reject over the following six weeks, with np=reject from day one.
6. BIMI with a CMC because the trademark registration is still pending.

#07Common mistakes

• Two SPF records on one name.
• Vendor DKIM (d=vendor.example) instead of your domain.
• Staying at p=none forever.
• Forgetting subdomains and non-existent subdomains.
• Publishing BIMI before DMARC is enforced.

#08Try it yourself

Send yourself a test from every tool that emails as your domain. In Gmail, open "Show original" and record SPF, DKIM and DMARC results and the domains. Build a table: tool, Return-Path domain, DKIM d= domain, aligned (yes or no).

#09Quick quiz

1. What makes DMARC pass? Answer: SPF or DKIM passes and its domain aligns with the From domain.

2. What is the SPF lookup limit? Answer: Ten DNS lookups.

3. Which DMARC tag is deprecated in RFC 9989? Answer: pct (also rf and ri).

4. What does BIMI need before it works? Answer: DMARC at quarantine or reject, an SVG Tiny PS logo and, for Gmail, a VMC or CMC.

#10What should you check before the next lesson?

• Every sender has custom DKIM and an aligned return-path.
• SPF is under ten lookups per domain.
• DMARC is published with reports going to a processor.
• You have a date for moving to quarantine.

Previous: Email compliance: GDPR, PECR, CAN-SPAM and CASL · Next: Gmail, Yahoo and Outlook sender requirements

Or return to the Email Marketing for Marketers track.

Related: Postmaster Tools v2 and deliverability monitoring · Domain warm-up and list hygiene · Cold outbound email done compliantly

#11Common questions

What DMARC policy do Gmail and Outlook require? Bulk senders need a DMARC record with at least p=none, and the From domain must align with SPF or DKIM. Stronger policies (quarantine or reject) are recommended and required for BIMI.

What is DMARC alignment? Alignment means the domain in the visible From address matches the domain authenticated by SPF (the envelope sender) or DKIM (the d= signing domain). Relaxed alignment allows subdomains of the same organisational domain.

What changed with RFC 9989? DMARC was republished as RFC 9989 in May 2026, replacing RFC 7489. The pct, rf and ri tags are deprecated, an np tag for non-existent subdomains is added, and organisational domains are found by a DNS tree walk instead of the Public Suffix List.

Do I need a VMC for BIMI in Gmail? A Verified Mark Certificate shows your logo with a blue checkmark and needs a registered trademark. A Common Mark Certificate shows the logo without the checkmark and does not need a trademark.