Email Deliverability for Musicians: SPF, DKIM, and DMARC Basics

Most artists learn about a newsletter delivery problem slowly. Open rates drift down, a fan mentions that the release email landed in spam, and nobody can say when it started. Often the music and the subject line had nothing to do with it. The message just couldn't prove where it came from.

Three DNS records handle that proof: SPF, DKIM, and DMARC. The names sound like a networking exam, and yes, the setup means pasting values into a settings page most musicians never open. It's still an afternoon of work at most. And since February 2024, Gmail and Yahoo have treated at least part of it as a requirement.

Why the inbox asks for proof

Anyone can type any name into the From line of an email. Phishing depends on that, which is why the big mailbox providers stopped trusting a From address on its own. When your newsletter reaches Gmail claiming to come from [email protected], Gmail checks whether your domain actually vouches for it.

SPF is a list, published in your domain's DNS, of the services allowed to send mail for that domain. If your newsletter platform sends the mail but isn't on the list, that counts against the message.

DKIM is a signature. Your platform signs each message with a private key, and the matching public key lives in your DNS. The receiving server checks one against the other and can tell whether the message was changed along the way.

DMARC connects both checks to the address your fans actually see. It tells receiving servers what to do with mail that fails, and it requires the domain in the From line to match the domain that passed SPF or DKIM. Google calls this alignment. A newsletter can pass SPF on the platform's own sending domain and still fail DMARC, because it never passed for yours.

What Gmail and Yahoo require

Google sorts senders into two groups. According to Google's sender guidelines, anyone sending to personal Gmail accounts needs SPF or DKIM, valid forward and reverse DNS, a TLS connection, and a spam rate in Postmaster Tools below 0.3 percent. Anyone sending more than 5,000 messages a day to Gmail accounts needs SPF, DKIM, and DMARC, with From-domain alignment and one-click unsubscribe on marketing mail. The DMARC policy for those senders can be set to none.

Yahoo's sender best practices line up closely: SPF or DKIM at minimum, a valid DMARC policy of at least p=none for bulk senders, one-click unsubscribe, and unsubscribes honored within two days.

Most independent artists will never send 5,000 Gmail messages in a day. Set up all three records anyway. Google recommends that, and the bulk-sender rules describe what a well-run list looks like at any size.

The spam number deserves more attention than it gets. Google's guidance asks senders to stay under 0.1 percent and never reach 0.3. Do the arithmetic on a 2,000-person list: two complaints on a single send is already 0.1 percent. No DNS record can offset that. Only a list of people who actually asked for your email can.

Setting it up without breaking anything

Your email platform supplies the record values. Mailchimp, for one, walks you through verifying a domain and then gives you the exact authentication records it expects. Most platforms have a similar screen labeled domain authentication or sender authentication. Use the values from the service that sends your newsletter, not an example from a blog post.

A few spots catch people every time.

One SPF record per domain. If your band domain already sends mail through Google Workspace, a website contact form, or a merch store, and you add a separate SPF record for the newsletter, you can break all of it. The fix is a single record that names every service. If the syntax looks foreign, ask your platform's support team how to merge it with what's already there.

Copy the DKIM value exactly. Those keys are long, and one dropped character means a failed signature. Watch the host name field too. Some DNS providers add your domain to the end automatically, so typing the full name gives you a doubled one.

Send from a domain you own. You can't publish DNS records for gmail.com or yahoo.com, so a free address can't be authenticated the way your own domain can. Most newsletter platforms will steer you toward your own domain for exactly that reason.

Start DMARC at p=none. That setting asks receivers to report what they see without rejecting anything, and it's the minimum both Google and Yahoo accept from bulk senders. Once the reports show your real mail passing, you can decide whether to tighten it.

Test it on a real message

After the records show as verified in your platform, send a campaign test to a Gmail address you control. Open it, click the three-dot menu, and choose Show original. Gmail lists SPF, DKIM, and DMARC near the top with a PASS or FAIL next to each.

Three passes means the technical side is done. A DKIM fail usually points to a copying error. An SPF pass with a DMARC fail usually means alignment: the platform is passing SPF for its own domain, and you still need its custom-domain or DKIM setup for yours.

Authentication proves who sent it

Authentication proves the mail is yours. It doesn't make anyone want it. The quickest route to the spam folder with perfect records is emailing people who never signed up: a bought list, a venue's ticket-buyer export, the contacts in your phone.

U.S. law applies here too. The FTC's CAN-SPAM compliance guide requires accurate sender information, subject lines that match the content, your valid physical postal address, and a clear way to opt out. Opt-outs must be honored within 10 business days, and the mechanism has to keep working for at least 30 days after a send. A registered P.O. box or private mailbox counts as the address, which helps if you'd rather not print your home address in every newsletter.

Hiring a platform doesn't hand off the responsibility. The FTC says both the business being promoted and the company that sends the message can be held legally responsible, and each violating email can carry a penalty of up to $53,088.

Before the next send

• The From address uses a domain you own.
• That domain has one SPF record, and it names every service that sends for you.
• Your platform shows the DKIM records as verified.
• A DMARC record exists, set to p=none to start.
• A test message in Gmail shows PASS for SPF, DKIM, and DMARC under Show original.
• The footer has a postal address and an unsubscribe link you've clicked yourself.
• You can say where every address on the list came from.

None of this will make a weak email good. It makes sure the email you worked on gets read and judged on what's in it.

For the list-building side, see our guides to building an artist email list and collecting fan signups at a live show.

Sources: Google Gmail sender guidelines; Yahoo Sender Hub best practices; Mailchimp email authentication guidance; FTC CAN-SPAM compliance guide.