SPF, DKIM and DMARC are records in your domain's DNS that prove to mailbox providers that an email with your sender address was really sent by someone you authorized. SPF defines which servers may send on behalf of your domain, DKIM digitally signs every email, and DMARC tells receiving servers what to do with a message that failed the checks. In Quanda you set up SPF, DKIM and sending domain verification with three CNAME records, and you add DMARC as one TXT record at your DNS provider.
| Setting | What it does | How to set it up |
|---|---|---|
| SPF | defines which servers may send for your domain | CNAME record from the Domain Verification & DNS page |
| DKIM | digitally signs every email | two CNAME records, marked "s1" and "s2" in Quanda |
| Sending domain verification | uses an address with your domain in the technical email header | the same CNAME records as SPF and DKIM |
| DMARC | says what to do with unauthenticated emails and sends reports | TXT record _dmarc at your DNS provider |
| Link branding | replaces onquanda.com in links with your domain | subdomain with a redirect |
| Dedicated IP address | sends only your emails, without other senders | plan extension |
You will find the setup procedure in How to set up DNS records for sending.
Why sender authentication matters
Mailbox providers such as Gmail protect their users from unwanted mail. They therefore require technical measures from bulk senders that show a message comes from the real sender. Gmail and Yahoo have required a verified domain with SPF and DKIM and a DMARC record since February 2024, Outlook.com since May 2025. You will find all the requirements in Gmail, Yahoo and Outlook requirements for bulk email senders.
A verified domain improves deliverability. More emails reach the main inbox and fewer end up in promotions or junk folders. It also protects your domain from abuse. Mailbox providers block or delete emails that only pretend to come from you before they reach recipients.
What is SPF
SPF (Sender Policy Framework) is a DNS record that defines which servers may send mail on behalf of your domain. The receiving server compares where the message came from with the list of allowed servers and can tell whether someone is impersonating you. By setting up SPF you authorize Quanda to send emails in your name.
What is DKIM
DKIM (DomainKeys Identified Mail) is a digital signature the sending server adds to every email. Thanks to asymmetric encryption, the recipient can verify that the email was sent by the domain stated in it and that its content was not changed on the way. DKIM builds your sender reputation over time. In Quanda, DKIM is handled by the records marked "s1" and "s2", the domain keys.
What is DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It does not verify anything itself, but it tells receiving servers what to do with a message that failed the SPF and DKIM checks. It also lets you receive reports about who sends mail in your name. DMARC is independent of Quanda and checks every email with your domain, whether it is sent from Quanda, Outlook or another service.
How to set up DMARC
- At your domain's DNS provider, add a record of type TXT named
_dmarc. - As the value, enter
v=DMARC1; p=none; pct=100; rua=mailto:you@example.com; sp=none; aspf=r; adkim=r;and replace you@example.com with your address for reports. - Set TTL to 3600 and save the record.
- Watch the reports. Once you see that all mail from your domain passes SPF and DKIM, change p=none to p=quarantine and later to p=reject.
The p=none policy blocks nothing, it only collects reports. Before you tighten it, list all the places your domain sends email from, for example regular correspondence, notifications from your online store or forms on your website. SPF and DKIM must be correct everywhere.
What is sending domain verification
Once your sending domain is verified, Quanda uses an address with your domain in the technical email header (smtp mail from). The header is not visible in the email, but mail servers use it to assess the email. Verification uses the same CNAME records as SPF and DKIM, so you set them up in one go.
What is link branding
Link branding replaces the onquanda.com domain in the links in your emails with your own domain, for example link.yourcompany.com. The links then look like yours, which strengthens the credibility of the email. See How to set up link branding.
When is a dedicated IP address worth it
The last element of reliable delivery is sending from your own (dedicated) IP address. You then do not share an IP address with other Quanda users and only your emails leave from it. The benefits:
- fewer emails end up in bulk and junk folders,
- more emails are delivered to the main inbox,
- fewer emails are filtered or blocked.
A dedicated IP address is a good fit when:
- you send regularly, at least once every 14 days,
- you send to at least hundreds of recipients a week on average,
- your recipients are mainly companies, that is company email addresses.
Whether you have a dedicated IP address assigned, you can check in Settings / Your account / Plan settings in the Extensions section. Quanda takes care of the DNS records of an assigned IP address.
Do you have questions? We will be happy to answer them. Just contact our customer support at +420 605 163 892, e-mail: support@onquanda.com.
Frequently asked questions
SPF defines which servers may send email on behalf of your domain. DKIM adds a digital signature to every email, so the recipient can verify that your domain sent the message and nobody changed it on the way. Bulk senders need both.
Gmail, Yahoo and Outlook.com require DMARC from senders of roughly 5,000 or more emails a day. We recommend setting it up in any case. With the p=none policy it blocks nothing, sends you reports and protects your domain from abuse.
Start with a TXT record named _dmarc with the value v=DMARC1; p=none; pct=100; rua=mailto:you@example.com; sp=none; aspf=r; adkim=r; using your own address for reports. Move to p=quarantine and later p=reject once the reports show that all mail from your domain is properly authenticated.
Yes. DMARC checks every email with your domain, no matter where it is sent from. Before you tighten the policy, list all the places your domain sends email from and check SPF and DKIM for each of them.
You cannot set up SPF, DKIM or DMARC on someone else's domain, and Gmail treats such bulk emails as impersonation. Change the sending address in Quanda to an address on your own company domain and verify it.
A dedicated IP address pays off when you send regularly, at least once every 14 days, to hundreds of recipients a week on average, and mainly to company addresses. Your deliverability is then not affected by other senders on a shared IP address.