> ## Documentation Index
> Fetch the complete documentation index at: https://testdocs.clodura.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Email Deliverability & Authentication — SPF, DKIM, DMARC

> Master SPF, DKIM, and DMARC authentication and learn the proven best practices that keep your emails out of spam and reliably in the inbox.

Email deliverability determines whether the messages you send actually reach your recipients' inboxes, rather than bouncing or disappearing into spam folders. Even a perfectly crafted cold email is worthless if it never gets seen. Technical authentication signals — not just content quality — are the primary factor email providers use to decide whether to trust your mail. Getting authentication right is the foundation for every other deliverability improvement you make inside Clodura AI.

## What Is Email Authentication?

Email authentication is a set of DNS-based methods that receiving mail servers use to verify that an email truly came from the domain shown in the "From" field, and that it wasn't tampered with in transit. The core protocol for sending email, SMTP, has no built-in authentication, which is why **SPF**, **DKIM**, and **DMARC** were developed to fill that gap. You need all three records configured to achieve a fully functioning authentication system.

<CardGroup cols={3}>
  <Card title="Email Setup" icon="gear" href="/docs/deliverability/email-setup">
    Connect Gmail or Microsoft 365 to Clodura AI and configure your sending preferences.
  </Card>

  <Card title="Email Warmup" icon="fire" href="/docs/deliverability/warmup">
    Gradually build your sender reputation with automated warmup campaigns.
  </Card>

  <Card title="Spam Score" icon="shield-check" href="/docs/deliverability/spam-score">
    Check your email content for spam triggers before you hit send.
  </Card>

  <Card title="Inbox Placement" icon="inbox" href="/docs/deliverability/inbox-placement">
    Test where your emails land across Google and Microsoft inboxes.
  </Card>
</CardGroup>

***

## The Three Authentication Protocols

### SPF — Sender Policy Framework

SPF answers one question: **is this IP address authorized to send email for this domain?** You publish a TXT record in your DNS that lists every mail server allowed to send on your behalf. When Bob receives an email from you, his mail server looks up your SPF record and checks whether the sending IP is listed. If it matches, the email passes SPF.

**What to include in your SPF record:** Add every service that sends email *using its own SMTP servers* on your domain's behalf — for example, Google Workspace, Microsoft 365, or a marketing tool like Mailgun.

<Note>
  **Do not add Clodura AI to your SPF record.** Clodura AI uses *your* SMTP credentials to send, so it sends as you, not via its own mail infrastructure. Adding it is unnecessary and could introduce confusion.
</Note>

**Example — combining two providers:**

```txt theme={null}
v=spf1 include:_spf.google.com include:mailgun.org ~all
```

**SPF records for popular providers:**

| Provider         | SPF Record                                       |
| ---------------- | ------------------------------------------------ |
| Google Workspace | `v=spf1 include:_spf.google.com ~all`            |
| Microsoft 365    | `v=spf1 include:spf.protection.outlook.com -all` |
| GoDaddy Email    | `v=spf1 include:secureserver.net -all`           |
| SendGrid         | `v=spf1 a include:sendgrid.net -all`             |
| Amazon SES       | `v=spf1 include:amazonses.com ~all`              |
| Zoho Mail        | `v=spf1 mx include:zoho.com ~all`                |
| Mailgun          | `v=spf1 include:mailgun.org ~all`                |
| Mailjet          | `v=spf1 include:spf.mailjet.com ~all`            |
| MailerLite       | `v=spf1 include:_spf.mlsend.com ~all`            |
| Rackspace        | `v=spf1 include:emailsrvr.com ~all`              |
| Fastmail         | `v=spf1 include:spf.messagingengine.com ?all`    |

<Warning>
  You can only have **one** SPF record per domain. Combine multiple providers into a single record rather than creating separate TXT entries — duplicate SPF records invalidate each other.
</Warning>

***

### DKIM — DomainKeys Identified Mail

DKIM proves that an email's content was **not altered in transit**. It works by signing each outgoing message with a cryptographic private key that only you hold. Your DNS record publishes the corresponding public key, and the recipient's mail server uses that public key to verify the signature. If the signature checks out, the message was genuinely sent by you and arrived unchanged.

**The two-key concept:**

* **Private key** — held securely by your email provider; used to encrypt a signature in every outgoing message header.
* **Public key** — published as a TXT record in your DNS; lets any receiving server decrypt and verify that signature.

Setting up DKIM means adding the public key TXT record your email provider generates into your DNS. You don't manage the private key yourself.

<Accordion title="How to set up DKIM for Gmail / Google Workspace">
  <Steps>
    <Step title="Open the Google Admin console">
      Sign in to [admin.google.com](https://admin.google.com/) with your Google Workspace admin account.
    </Step>

    <Step title="Navigate to Gmail authentication settings">
      Go to **Apps → Google Workspace → Gmail → Authenticate Email**.
    </Step>

    <Step title="Generate a new DKIM record">
      Select your domain from the drop-down list and click **Generate New Record**. Copy the hostname (e.g., `google._domainkey`) and the TXT record value.
    </Step>

    <Step title="Add the TXT record to your DNS">
      Log in to your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.), find your domain, and add a new **TXT** record using the hostname and value you copied.
    </Step>

    <Step title="Start DKIM authentication">
      Return to the Google Admin console and click **Start Authentication**. Allow up to 48 hours for DNS propagation.
    </Step>
  </Steps>
</Accordion>

***

### DMARC — Domain-based Message Authentication, Reporting & Conformance

DMARC builds on top of SPF and DKIM by giving you a policy that tells recipient mail servers what to do with messages that **fail** your SPF or DKIM checks. It also enables reporting, so you can receive data about how your domain's email is being handled across the internet.

A DMARC record is published as a single TXT entry in DNS, at the hostname `_dmarc.yourdomain.com`.

**Example DMARC record:**

```txt theme={null}
v=DMARC1; p=none; rua=mailto:admin@yourdomain.com;
```

**How DMARC evaluates a message:** A message must pass at least one of the following for DMARC to succeed:

1. **SPF pass + alignment** — the domain in the envelope "From" matches the domain in the email header "From."
2. **DKIM pass + alignment** — the domain in the DKIM signature matches the domain in the email header "From."

A message fails DMARC only if it fails *both* SPF and DKIM.

#### DMARC Policy Options

| Policy         | Tag            | What Happens                                                                                                             |
| -------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **None**       | `p=none`       | All messages are delivered, even if they fail SPF/DKIM. Reports are still sent. Good for monitoring without enforcement. |
| **Quarantine** | `p=quarantine` | Messages that fail are sent to the recipient's spam or junk folder.                                                      |
| **Reject**     | `p=reject`     | Messages that fail are rejected outright and never delivered. Highest security level.                                    |

<Tip>
  Start with `p=none` while you set up SPF and DKIM and confirm your reports look clean. Then move to `p=quarantine`, and eventually `p=reject` once you are confident all legitimate mail is authenticated.
</Tip>

**DMARC record fields explained:**

| Tag   | Required    | Description                                                                                 |
| ----- | ----------- | ------------------------------------------------------------------------------------------- |
| `v`   | Yes         | Version — always `DMARC1`. Do not change this.                                              |
| `p`   | Yes         | Policy — `none`, `quarantine`, or `reject`.                                                 |
| `rua` | Recommended | Email address to receive aggregate reports. Must belong to the same domain.                 |
| `ruf` | Optional    | Email address for forensic (per-failure) reports.                                           |
| `fo`  | Optional    | Reporting conditions: `0` = report if both SPF and DKIM fail; `1` = report if either fails. |

***

## DNS Setup Walkthroughs

<Tabs>
  <Tab title="Cloudflare">
    ### Adding SPF or DMARC in Cloudflare

    <Steps>
      <Step title="Log in to Cloudflare">
        Navigate to [cloudflare.com](https://cloudflare.com) and sign in.
      </Step>

      <Step title="Select your domain and open DNS">
        From the dashboard, click your domain, then click the **DNS** tab.
      </Step>

      <Step title="Add a new TXT record">
        Click **Add record**. Set the **Type** to `TXT`. For SPF, set **Name** to `@`. For DMARC, set **Name** to `_dmarc`. Paste the record value into **Content**, keep TTL on **Auto**, and click **Save**.
      </Step>
    </Steps>

    DNS changes in Cloudflare typically take effect within 30 minutes.
  </Tab>

  <Tab title="GoDaddy">
    ### Adding SPF or DMARC in GoDaddy

    <Steps>
      <Step title="Sign in to GoDaddy">
        Go to your [GoDaddy portfolio](https://dcc.godaddy.com/control/portfolio) and sign in.
      </Step>

      <Step title="Open DNS management">
        In **All Products and Services**, find your domain and click the **DNS** button next to it.
      </Step>

      <Step title="Add a new record">
        Click **Add New Record**. Set **Type** to `TXT`. For SPF, set **Host** to `@`. For DMARC, set **Host** to `_dmarc`. Paste your record value into **Value**, leave **TTL** at the default 1 hour, and click **Save**.
      </Step>
    </Steps>

    <Warning>
      When copying SPF or DMARC values, do not introduce any leading or trailing spaces — that will invalidate the record. Most DNS updates take effect within an hour but can take up to 48 hours globally.
    </Warning>
  </Tab>
</Tabs>

***

## Email Deliverability Best Practices

Proper authentication is the baseline. The following practices build on top of it to maximize inbox placement and protect your sender reputation over time.

<Steps>
  <Step title="Authenticate your domain">
    Configure SPF, DKIM, and DMARC records before sending any outreach. After connecting your email in Clodura AI, the **Domain Health** panel in Settings → Email Setup shows green checkmarks when all three are correctly detected.
  </Step>

  <Step title="Keep a clean email list">
    Remove bounced, invalid, and long-unengaged addresses regularly. Clodura's built-in email verification engine tags contacts as **Verified** or **Not Found** — send only to Verified contacts for the best deliverability results.
  </Step>

  <Step title="Warm up new domains and IPs">
    New sending domains have no reputation history. Start with 20–30 emails per day to your most engaged contacts, then increase volume by 10–30% every few days. Use Clodura's [Email Warmup](/docs/deliverability/warmup) feature to automate this process.
  </Step>

  <Step title="Write relevant, human content">
    Craft subject lines that honestly reflect the email's content. Personalize messages using the recipient's name, role, industry, or company. Keep calls to action clear and single. Avoid excessive punctuation, ALL CAPS, and dollar-sign-heavy language.
  </Step>

  <Step title="Monitor sender reputation">
    Google requires spam complaint rates below 0.3%. Connect your domain to [Google Postmaster Tools](https://support.google.com/a/answer/9981691) for free reputation monitoring. Also check [Microsoft SNDS](https://sendersupport.olc.protection.outlook.com/snds/index), [Sender Score by Validity](https://www.validity.com/sender-score/), and [MXToolbox Blacklist Check](https://mxtoolbox.com/blacklists.aspx) regularly.
  </Step>

  <Step title="Stay legally compliant">
    Align your outreach with applicable regulations:

    * **GDPR (EU):** Obtain explicit consent, provide a data access/erasure mechanism, and document your consent records.
    * **CAN-SPAM (US):** Use accurate header information, non-deceptive subject lines, a valid physical address, and a working unsubscribe mechanism.
    * **CCPA (California):** Publish a privacy policy, honor opt-out requests, and ensure third-party processors also comply.
  </Step>

  <Step title="Maintain a consistent sending schedule">
    Sudden spikes in volume from a domain with no history look suspicious to spam filters. Send at regular intervals and ramp gradually. Use Clodura's sequence scheduling to maintain predictable cadences.
  </Step>

  <Step title="Check spam score and test inbox placement">
    Before any major send, run a [Spam Score check](/docs/deliverability/spam-score) (10 credits) to catch risky content and flagged phrases. Run an [Inbox Placement test](/docs/deliverability/inbox-placement) (50 credits) to see where your emails actually land across Google Workspace and Microsoft 365 inboxes.
  </Step>
</Steps>

***

## Verifying Your Setup in Clodura AI

After connecting your email account under **Settings → Email Setup**, Clodura automatically checks your domain's DNS configuration and displays three health indicators:

| Indicator | What It Checks                   | What to Do If Red                                             |
| --------- | -------------------------------- | ------------------------------------------------------------- |
| **SPF**   | SPF TXT record present and valid | Add or correct your SPF record in DNS                         |
| **DKIM**  | DKIM public key TXT record found | Generate and publish your DKIM record via your email provider |
| **DMARC** | DMARC TXT record at `_dmarc`     | Add a DMARC record to your DNS with at minimum `p=none`       |

If any indicator shows red, your emails are at high risk of landing in spam. Fix DNS records before launching any outreach campaigns.

<Info>
  DNS changes propagate across the internet within 30 minutes to 48 hours. After making changes, wait before re-running the health check.
</Info>