Skip to main content
Email deliverability determines whether the messages you send actually reach your recipients’ inboxes, rather than bouncing or disappearing into spam folders. Even a perfectly crafted cold email is worthless if it never gets seen. Technical authentication signals — not just content quality — are the primary factor email providers use to decide whether to trust your mail. Getting authentication right is the foundation for every other deliverability improvement you make inside Clodura AI.

​
What Is Email Authentication?

Email authentication is a set of DNS-based methods that receiving mail servers use to verify that an email truly came from the domain shown in the “From” field, and that it wasn’t tampered with in transit. The core protocol for sending email, SMTP, has no built-in authentication, which is why SPF, DKIM, and DMARC were developed to fill that gap. You need all three records configured to achieve a fully functioning authentication system.

Email Setup

Connect Gmail or Microsoft 365 to Clodura AI and configure your sending preferences.

Email Warmup

Gradually build your sender reputation with automated warmup campaigns.

Spam Score

Check your email content for spam triggers before you hit send.

Inbox Placement

Test where your emails land across Google and Microsoft inboxes.

​
The Three Authentication Protocols

​
SPF — Sender Policy Framework

SPF answers one question: is this IP address authorized to send email for this domain? You publish a TXT record in your DNS that lists every mail server allowed to send on your behalf. When Bob receives an email from you, his mail server looks up your SPF record and checks whether the sending IP is listed. If it matches, the email passes SPF. What to include in your SPF record: Add every service that sends email using its own SMTP servers on your domain’s behalf — for example, Google Workspace, Microsoft 365, or a marketing tool like Mailgun.
Do not add Clodura AI to your SPF record. Clodura AI uses your SMTP credentials to send, so it sends as you, not via its own mail infrastructure. Adding it is unnecessary and could introduce confusion.
Example — combining two providers: 
v=spf1 include:_spf.google.com include:mailgun.org ~all
SPF records for popular providers:
ProviderSPF Record
Google Workspacev=spf1 include:_spf.google.com ~all
Microsoft 365v=spf1 include:spf.protection.outlook.com -all
GoDaddy Emailv=spf1 include:secureserver.net -all
SendGridv=spf1 a include:sendgrid.net -all
Amazon SESv=spf1 include:amazonses.com ~all
Zoho Mailv=spf1 mx include:zoho.com ~all
Mailgunv=spf1 include:mailgun.org ~all
Mailjetv=spf1 include:spf.mailjet.com ~all
MailerLitev=spf1 include:_spf.mlsend.com ~all
Rackspacev=spf1 include:emailsrvr.com ~all
Fastmailv=spf1 include:spf.messagingengine.com ?all
You can only have one SPF record per domain. Combine multiple providers into a single record rather than creating separate TXT entries — duplicate SPF records invalidate each other.

​
DKIM — DomainKeys Identified Mail

DKIM proves that an email’s content was not altered in transit. It works by signing each outgoing message with a cryptographic private key that only you hold. Your DNS record publishes the corresponding public key, and the recipient’s mail server uses that public key to verify the signature. If the signature checks out, the message was genuinely sent by you and arrived unchanged. The two-key concept:
  • Private key — held securely by your email provider; used to encrypt a signature in every outgoing message header.
  • Public key — published as a TXT record in your DNS; lets any receiving server decrypt and verify that signature.
Setting up DKIM means adding the public key TXT record your email provider generates into your DNS. You don’t manage the private key yourself.
1

Open the Google Admin console

Sign in to admin.google.com with your Google Workspace admin account.
2

Navigate to Gmail authentication settings

Go to Apps → Google Workspace → Gmail → Authenticate Email.
3

Generate a new DKIM record

Select your domain from the drop-down list and click Generate New Record. Copy the hostname (e.g., google._domainkey) and the TXT record value.
4

Add the TXT record to your DNS

Log in to your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.), find your domain, and add a new TXT record using the hostname and value you copied.
5

Start DKIM authentication

Return to the Google Admin console and click Start Authentication. Allow up to 48 hours for DNS propagation.

​
DMARC — Domain-based Message Authentication, Reporting & Conformance

DMARC builds on top of SPF and DKIM by giving you a policy that tells recipient mail servers what to do with messages that fail your SPF or DKIM checks. It also enables reporting, so you can receive data about how your domain’s email is being handled across the internet. A DMARC record is published as a single TXT entry in DNS, at the hostname _dmarc.yourdomain.com. Example DMARC record: 
v=DMARC1; p=none; rua=mailto:admin@yourdomain.com;
How DMARC evaluates a message: A message must pass at least one of the following for DMARC to succeed:
  1. SPF pass + alignment — the domain in the envelope “From” matches the domain in the email header “From.”
  2. DKIM pass + alignment — the domain in the DKIM signature matches the domain in the email header “From.”
A message fails DMARC only if it fails both SPF and DKIM.

​
DMARC Policy Options

PolicyTagWhat Happens
Nonep=noneAll messages are delivered, even if they fail SPF/DKIM. Reports are still sent. Good for monitoring without enforcement.
Quarantinep=quarantineMessages that fail are sent to the recipient’s spam or junk folder.
Rejectp=rejectMessages that fail are rejected outright and never delivered. Highest security level.
Start with p=none while you set up SPF and DKIM and confirm your reports look clean. Then move to p=quarantine, and eventually p=reject once you are confident all legitimate mail is authenticated.
DMARC record fields explained:
TagRequiredDescription
vYesVersion — always DMARC1. Do not change this.
pYesPolicy — none, quarantine, or reject.
ruaRecommendedEmail address to receive aggregate reports. Must belong to the same domain.
rufOptionalEmail address for forensic (per-failure) reports.
foOptionalReporting conditions: 0 = report if both SPF and DKIM fail; 1 = report if either fails.

​
DNS Setup Walkthroughs

​
Adding SPF or DMARC in Cloudflare

1

Log in to Cloudflare

Navigate to cloudflare.com and sign in.
2

Select your domain and open DNS

From the dashboard, click your domain, then click the DNS tab.
3

Add a new TXT record

Click Add record. Set the Type to TXT. For SPF, set Name to @. For DMARC, set Name to _dmarc. Paste the record value into Content, keep TTL on Auto, and click Save.
DNS changes in Cloudflare typically take effect within 30 minutes.

​
Email Deliverability Best Practices

Proper authentication is the baseline. The following practices build on top of it to maximize inbox placement and protect your sender reputation over time.
1

Authenticate your domain

Configure SPF, DKIM, and DMARC records before sending any outreach. After connecting your email in Clodura AI, the Domain Health panel in Settings → Email Setup shows green checkmarks when all three are correctly detected.
2

Keep a clean email list

Remove bounced, invalid, and long-unengaged addresses regularly. Clodura’s built-in email verification engine tags contacts as Verified or Not Found — send only to Verified contacts for the best deliverability results.
3

Warm up new domains and IPs

New sending domains have no reputation history. Start with 20–30 emails per day to your most engaged contacts, then increase volume by 10–30% every few days. Use Clodura’s Email Warmup feature to automate this process.
4

Write relevant, human content

Craft subject lines that honestly reflect the email’s content. Personalize messages using the recipient’s name, role, industry, or company. Keep calls to action clear and single. Avoid excessive punctuation, ALL CAPS, and dollar-sign-heavy language.
5

Monitor sender reputation

Google requires spam complaint rates below 0.3%. Connect your domain to Google Postmaster Tools for free reputation monitoring. Also check Microsoft SNDS, Sender Score by Validity, and MXToolbox Blacklist Check regularly.
6

Stay legally compliant

Align your outreach with applicable regulations:
  • GDPR (EU): Obtain explicit consent, provide a data access/erasure mechanism, and document your consent records.
  • CAN-SPAM (US): Use accurate header information, non-deceptive subject lines, a valid physical address, and a working unsubscribe mechanism.
  • CCPA (California): Publish a privacy policy, honor opt-out requests, and ensure third-party processors also comply.
7

Maintain a consistent sending schedule

Sudden spikes in volume from a domain with no history look suspicious to spam filters. Send at regular intervals and ramp gradually. Use Clodura’s sequence scheduling to maintain predictable cadences.
8

Check spam score and test inbox placement

Before any major send, run a Spam Score check (10 credits) to catch risky content and flagged phrases. Run an Inbox Placement test (50 credits) to see where your emails actually land across Google Workspace and Microsoft 365 inboxes.

​
Verifying Your Setup in Clodura AI

After connecting your email account under Settings → Email Setup, Clodura automatically checks your domain’s DNS configuration and displays three health indicators:
IndicatorWhat It ChecksWhat to Do If Red
SPFSPF TXT record present and validAdd or correct your SPF record in DNS
DKIMDKIM public key TXT record foundGenerate and publish your DKIM record via your email provider
DMARCDMARC TXT record at _dmarcAdd a DMARC record to your DNS with at minimum p=none
If any indicator shows red, your emails are at high risk of landing in spam. Fix DNS records before launching any outreach campaigns.
DNS changes propagate across the internet within 30 minutes to 48 hours. After making changes, wait before re-running the health check.