Honestly, I never set up SPF, DKIM or DMARC records myself when I was growing Anywhere Income to 12,000 subscribers. That’s the point of this guide: on beehiiv, MailerLite and similar email platforms, the platform does most of the work for you. If you send from the platform’s own address, there’s often nothing to do. If you send from your own domain, the platform hands you a few records to copy into your domain settings, and on some DNS providers it adds them for you.
Platform details on this page were last checked 2 Nov 2026 against each platform’s own help pages, linked below. The Google and Yahoo rules were checked the same day on their sender pages.
SPF, DKIM and DMARC in plain English
All three are records published in a domain’s DNS settings (the address book for a domain). Receiving mail servers look them up to decide whether an email claiming to be from that domain really is.
| Record | What it does | Plain-English version |
|---|---|---|
| SPF (Sender Policy Framework) | Lists the servers allowed to send email for your domain | “These are the post offices allowed to send my letters” |
| DKIM (DomainKeys Identified Mail) | Adds a digital signature to each email that the receiver checks against a key in your DNS | “Here’s my signature, check it against the one on file” |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) | Tells receivers what to do if SPF or DKIM fails, and where to send reports | “If something fails the checks, here’s what to do with it, and tell me about it” |
That matches how beehiiv’s DMARC article explains them. One detail matters for DMARC: the domain in your visible From address has to line up with the domain that passed SPF or DKIM. Google and Yahoo both call this alignment. When you send from your own domain through a platform, its setup records are what create that alignment.
On the platform’s default address, it’s handled
Most newsletter platforms let you start sending without touching DNS at all, because they send from a domain they own and control.
- beehiiv. By default you send from a beehiiv address in the form your-publication@mail.beehiiv.com, according to beehiiv’s help article on email usernames. beehiiv says its automatic DMARC applies to beehiiv subdomains, so there’s no DMARC record for you to add there.
- Kit. By default your From address is your own email, but the hidden return path is a Kit address, per Kit’s verified sending domain guide. Kit’s deliverability checklist says that if your domain already has a DMARC record, you’ll need a verified sending domain for Kit emails to pass DMARC.
- MailerLite is the exception among these three. It requires you to authenticate a custom domain to send, apart from the first 14 days of a new account’s trial, per MailerLite’s domain authentication guide. It still does most of the work: it gives you the exact records, and can add them automatically for some DNS providers.
This is why I lead with beehiiv for most new newsletters: you can start on its free plan, send from its domain, and leave all of this until you want your own. Try beehiiv, or read the beehiiv review first.
When you send from your own domain
Sending from your own domain (news@yourname.com rather than a platform address) looks more professional and builds a reputation that belongs to you, which also helps if you ever switch platforms. The cost is a one-time DNS setup. Each platform walks you through it.
| Platform | Where to start | What you add | DMARC |
|---|---|---|---|
| beehiiv | Settings, then Domains, then set up a custom domain | Records beehiiv generates for your email sending domain (it creates CNAME records that handle SPF and DKIM). An automatic option connects to your DNS provider and adds them for you | Required for every custom sending domain since February 2024. beehiiv has a DMARC wizard |
| MailerLite | Account settings, then Domains, then add sending domain | A DKIM CNAME record, an SPF TXT record and a verification TXT record. Automatic setup for partner DNS providers | MailerLite says senders sending around 5,000 or more emails at a time also need a DMARC policy |
| Kit | Settings, then Email, then Verified Sending Domains | CNAME records Kit provides. An automatic option uses Entri to configure your DNS | Kit provides a default p=none DMARC record to copy if you don’t have one |
Sources: beehiiv’s automatic setup and manual setup articles, MailerLite’s domain authentication guide and authentication policy article, and Kit’s DMARC article, all checked 2 Nov 2026.
A few things that trip people up:
- Only one SPF record per domain. If you already use another service that sends from your domain (Google Workspace or Microsoft 365, for example), you merge the entries into one record rather than adding a second. MailerLite has a guide to merging SPF records.
- Only one DMARC record per domain, however many services send for it.
- Give it time. beehiiv says verification can take up to 72 hours; MailerLite says up to 24 hours. Wait until your platform shows the sending domain as verified or live before you send from it.
- Don’t delete the records later. Kit warns that removing a DMARC record once added can cause deliverability problems.
The Gmail and Yahoo sender rules
From February 2024, Google and Yahoo started enforcing stricter rules for anyone sending to their users. Here’s what their own pages say, checked 2 Nov 2026.
| Requirement | Google (sender guidelines) | Yahoo (sender best practices) |
|---|---|---|
| Authentication, all senders | SPF or DKIM | SPF or DKIM at a minimum |
| Authentication, bulk senders | SPF and DKIM, plus DMARC, if you send more than 5,000 messages a day to Gmail accounts | SPF and DKIM, plus DMARC, for bulk senders (Yahoo’s page doesn’t give a number) |
| DMARC policy | Can be set to none | At least p=none; a rua reporting address strongly recommended |
| From alignment | From domain must align with the SPF or DKIM domain (bulk senders) | Same (bulk senders) |
| Unsubscribe | One-click unsubscribe and a visible unsubscribe link for marketing and subscribed messages (bulk senders) | One-click unsubscribe header plus a visible link; honour unsubscribes within 2 days |
| Spam rate | Below 0.3% in Postmaster Tools | Below 0.3% |
Two practical points for a newsletter:
- You may cross 5,000 a day sooner than you think. Google counts messages per day, not list size, so a single send to a list with 5,000 or more Gmail addresses can put you over.
- Your platform handles the unsubscribe mechanics. The newsletter platforms add an unsubscribe link to every send. Your part is not hiding it and not making people jump through hoops.
A starter DMARC policy
If you add DMARC yourself, start in monitoring mode. This is the shape of record used in beehiiv’s DMARC example and Kit’s default record:
Type: TXT
Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com- p=none tells receivers to take no action and just report. It meets Google’s and Yahoo’s minimum.
- rua= is where summary reports go. Use an inbox you don’t mind filling up; the reports are machine-readable files, so a free DMARC report analyser helps.
- Then tighten. Once the reports show your newsletter platform (and anything else sending as your domain, such as your work email) passing, move to p=quarantine, then p=reject. Kit’s guide to increasing DMARC suggests a couple of weeks at each step. If you’re not sure everything that sends for your domain is covered, staying on p=none is the safe choice.
Quick ways to check it’s working
- Your platform’s domain page. beehiiv, MailerLite and Kit all show whether your sending domain is verified. Start there.
- Send a test to a Gmail address and use Show original, as described in Google’s guide to email headers. You should see SPF, DKIM and DMARC listed as passing.
- Look up your DMARC record with a free checker such as MXToolbox’s DMARC lookup, which Kit’s help centre points to.
- Test at more than one provider. Send to your own Gmail, Outlook and Yahoo addresses before a big send, especially after a platform move.
- Watch your spam rate in Google Postmaster Tools once you send at volume from your own domain.
Authentication gets you to the door, engagement gets you in
Passing SPF, DKIM and DMARC tells Gmail the email really is from you. It doesn’t make anyone want to read it. What gets your newsletter into the primary inbox, in my experience, is how readers behave:
- Get replies early. The main job of my first welcome email is to get a reply, or to get the email moved into the primary inbox. Even one reply trains the inbox provider to put your future emails where the subscriber sees them. The structure is in how to start a newsletter.
- Prune. Anyone who hasn’t opened in about three months gets a few “are you still interested?” emails, then I remove them. A critical mass of people ignoring you, or marking you as spam, hurts inbox placement whatever your DNS says. See list pruning and open rates.
- Don’t trust open rates to tell you it’s working. Apple Mail Privacy Protection can record opens nobody made. Replies, clicks and what people do after they click are better signals of whether you’re reaching people.
The short version
- On beehiiv’s default address, authentication is handled for you. On Kit’s default setup, mostly too.
- On your own domain, beehiiv, MailerLite and Kit give you the records and walk you through them, and some can add them for you. It’s a one-time job.
- Add a p=none DMARC record with reports, then tighten slowly.
- After that, spend your effort on replies and pruning, not DNS.
Comparing platforms? Best newsletter platforms covers the field, and the MailerLite and Kit reviews have the plan details. Background on me is on about Lewis.
Frequently asked questions
Do I need SPF, DKIM and DMARC on beehiiv?
Not if you send from beehiiv's own subdomain: beehiiv handles authentication there, including DMARC. If you send from your own domain, beehiiv gives you the records to add (or adds them for you through its automatic setup) and requires a DMARC record, per its help docs checked 2 Nov 2026.
Does MailerLite need domain authentication?
Yes, if you send from a custom domain, which MailerLite expects you to do. New accounts can send without it only during the 14-day trial. MailerLite walks you through a DKIM record, an SPF record and a verification record, with automatic setup for some DNS providers.
Do I need DMARC for a small newsletter?
Gmail requires DMARC if you send more than 5,000 messages a day to Gmail accounts, and Yahoo requires it for bulk senders. beehiiv requires it for every custom sending domain. Below those thresholds it's still worth adding a p=none record because it's quick and gives you reports.
What DMARC policy should I start with?
Start with p=none and a reporting address (rua), which collects reports without changing delivery. Once the reports show your platform passing, move to p=quarantine and later p=reject, a couple of weeks at each step, as Kit's help centre suggests.
Can I send a newsletter from a Gmail address?
It's a bad idea. MailerLite says emails sent from public domains like Gmail and Hotmail are more likely to be flagged as untrustworthy, and you can't authenticate a domain you don't own. Use your platform's default sending address or your own domain.
Will setting up DMARC stop my newsletter going to spam?
Not on its own. Authentication proves the email is really from you. Whether it lands in the inbox depends mostly on how readers react: replies, clicks, and few spam complaints. Gmail and Yahoo both ask senders to keep spam rates below 0.3%.