October 2026Dataset Refreshed: Expanded to 15.17M+ Unique Contacts
[email protected]+1 727-617-0017

What are SPF, DKIM and DMARC?

Also called: SPF, DKIM, DMARC, email authentication

SPF, DKIM and DMARC are email authentication standards that prove a message really comes from your domain. SPF lists the servers allowed to send for you, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail.

By John Britton, VP of Marketing, MedicalProspects · Updated November 4, 2026 · Email & Deliverability

Why it matters for healthcare sales and marketing

Mailbox providers trust authenticated mail more, and Google and Yahoo now require bulk senders to authenticate. Without it, even well-targeted campaigns can land in spam, and others can spoof your domain.

How it works

  • SPF (Sender Policy Framework): a DNS record listing the mail servers allowed to send for your domain.
  • DKIM (DomainKeys Identified Mail): a signature on each message, checked against a public key in your DNS.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance): a DNS policy that tells receivers to accept, quarantine or reject mail that fails SPF or DKIM alignment, and sends you reports.

Set them up for every tool that sends email for you: CRM, marketing automation and sales engagement platforms.

Three authentication standards: SPF (which servers may send), DKIM (signed messages) and DMARC (what to do when checks fail, plus reports).
SPF, DKIM and DMARC together prove your email is really from you.

Example

Illustrative scenario. A MedTech marketing team adds a new sales engagement tool and sees replies drop. DMARC reports show the tool's emails fail authentication. IT adds the tool to SPF and sets up its DKIM key, and deliverability recovers.

Common mistakes

  • Forgetting third-party senders. Every tool that sends for you needs to pass.
  • Jumping straight to a strict DMARC policy. Start with monitoring, then tighten.
  • Never reading DMARC reports. They show who is sending as you.

Related terms

  • Sender ReputationSender reputation is how mailbox providers such as Gmail and Outlook judge the trustworthiness of your sending domain and IP addresses, based on signals like spam complaints, bounces, spam trap hits, engagement and authentication.
  • Spam TrapA spam trap is an email address used by mailbox providers and blocklist operators to catch senders with poor list practices. It belongs to no real person who signed up, so any email it receives signals that the sender's list wasn't collected or maintained properly.
  • Bounce Rate (Hard and Soft Bounces)Bounce rate is the share of sent emails that were returned as undeliverable. Hard bounces are permanent failures, such as an address that doesn't exist; soft bounces are temporary, such as a full mailbox or a server that is briefly unavailable.
  • CAN-SPAM ActThe CAN-SPAM Act is the U.S. law that sets the rules for commercial email, including business-to-business email. It doesn't require prior consent, but it does require honest sender information and subject lines, a physical postal address, a working opt-out, and handling opt-outs within 10 business days.

Put it to work

Sources

  1. Email sender guidelines, Google
  2. DMARC overview, DMARC.org

← Back to the healthcare GTM glossary