SPF, DKIM, DMARC — setting up email authentication.

Without SPF/DKIM/DMARC, your emails get filtered as spam. Modern receivers (Gmail, Outlook, Yahoo) require all three for inbox placement at scale.

Using Rivervo Business email?

Then you don't need to compose these records yourself. Open the project → Email tab in the new panel: it lists the exact MX, SPF and DKIM records (required) and DMARC (recommended), each marked Found or Not found yet. Copy the values from there, add them where your domain's DNS lives, then click I've added the records — check.

Where to add them:

• Domain on Rivervo nameservers with a Rivervo website → Website → DNS zone (there's a button on the card)
• Domain registered at Rivervo with other DNS → the domain's DNS records
• Anywhere else → at your registrar or DNS host (on Cloudflare: DNS only, not proxied)

The rest of this article explains what the records mean and covers mail sent from your website hosting.

Mail on the hosting: check and fix in one click

Project → Email → Delivery shows the Mail records of each domain — SPF, DKIM, MX — and marks what needs fixing. Fix sets the missing records up for you when the domain is on Rivervo nameservers.

SPF (Sender Policy Framework)

A TXT record on your root domain listing every server allowed to send mail "from" your domain.

For mail sent from your hosting on Rivervo nameservers, the record is created for you (Delivery → Fix if it is missing). To verify:

dig +short TXT yourdomain.com | grep spf

You should see something like:

"v=spf1 +a +mx +ip4:203.0.113.10 ~all"

If you also send mail through another service (your newsletter tool, Google Workspace, etc.), merge them into one SPF:

"v=spf1 +a +mx +ip4:203.0.113.10 include:_spf.google.com include:servers.mcsv.net ~all"

One SPF record per domain. Two records cause permerror and rejection.

DKIM (DomainKeys Identified Mail)

Cryptographic signature on each outgoing message. Receivers verify against your published public key.

For mail on the hosting, it is set up for you. To verify:

dig +short TXT default._domainkey.yourdomain.com

Should return a long base64 string starting with v=DKIM1.

If missing, Email → Delivery → Fix next to the domain.

DMARC

A policy record that tells receivers what to do when SPF or DKIM fail.

Add a TXT record yourself:

Website → DNS zone → Add a record → type TXT:

Name:  _dmarc.yourdomain.com
Type:  TXT
Value: "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100"

Start with p=none for two weeks — collect reports, see who's sending mail "as you".

After two weeks of clean reports, change to p=quarantine (failed mail goes to spam).

After another two weeks, change to p=reject (failed mail bounced).

This staged rollout prevents accidentally rejecting legitimate mail from third-party services you forgot to add to SPF.

Checking the full setup

Send a test email to mail-tester.com (they give you a unique address). Check the score.

SpamAssassin score:    -0.0    ✓
Authentication (SPF):  pass    ✓
Authentication (DKIM): pass    ✓
Authentication (DMARC):pass    ✓
Reverse DNS:           ok      ✓
Total: 9.5/10

Aim for 9.5 or higher. Below that, the report tells you what's failing.

Common errors

SPF: permerror — too many DNS lookups. SPF allows max 10 include: lookups. If you have many, combine into one record or use SPF flattening (services like dmarcian or easydmarc do this for you).

DKIM: permfail — signature verification failed. The public key in DNS doesn't match the key mail is signed with. Email → Delivery → Fix puts the right one in DNS.

DMARC: none. No record published. Add one (see above).

"Why is my mail still landing in spam?" Authentication is necessary but not sufficient. Other factors: IP reputation (check mxtoolbox.com/blacklists), content (no spam-trigger words), recipient engagement (mail you send to people who don't open hurts reputation).

Bulk sending

Hosting plans have an hourly limit on outgoing email, and shared servers aren't built for newsletters. For 1000+ recipient batches, don't send through the hosting — use a dedicated sending service:

• Mailgun — pay-as-you-go
• Postmark — transactional mail
• Amazon SES — low cost at volume

These services handle blocklist disputes and reputation management you'd otherwise have to do yourself.