How to Configure SPF DKIM DMARC in Brandjet

Learn how to configure SPF DKIM DMARC in Brandjet and improve inbox placement while protecting your domain.

---

Email problems often start with your domain, not your writing. You can send a good campaign and still land in spam if your email setup is wrong. Fixing SPF, DKIM, and DMARC gives your emails a better shot at reaching the inbox.

These three records help prove your emails are real. Set them up before you send anything. If you want better deliverability, keep reading.

👉 You can set up everything inside BrandJet before your next campaign goes out.

Table of Contents

29 sections Show

What You Need Before You Configure SPF, DKIM, and DMARC

SPF, DKIM, and DMARC each do a different job. Together, they help inbox providers trust your email. If one is missing, delivery can drop.

• SPF approves your sending tools: It tells email providers which servers can send email for your domain.
• DKIM proves the email is unchanged: It adds a signature to show the email was not changed after sending.
• DMARC handles failed checks: It tells inbox providers what to do when SPF or DKIM fails.

Think of it like a lock, a seal, and a rulebook. Each one matters.

How SPF Works In Brandjet

SPF is the first check your email goes through. It tells inbox providers which servers are allowed to send email from your domain. If your sending server is not listed, your email may be rejected or marked as spam.

In BrandJet, SPF setup starts with one DNS record.

As highlighted by AgentMail Documentation

“To authorize BrandJet’s mail servers, you must update your SPF record to include the designated sender mechanism. Specifically, add include:agentmail.to to your existing SPF TXT record. For DKIM, BrandJet uses a CNAME-based setup to manage signing keys automatically; you must add the record agentmail._domainkey to your DNS settings.” – AgentMail Documentation

SPF Setup

Most teams only need one SPF record. The goal is simple: list every approved sender in one place.

1. Log in to your DNS provider
2. Add a TXT record
3. Paste this SPF value:

v=spf1 include:_spf.brandjet.ai include:spf.google.com ~all

1. Save the record
2. Wait for DNS updates (this can take up to 24 hours)
3. Check the record in BrandJet or a DNS checker

A small mistake here can block delivery.

SPF Record Comparison

Setup Type	Result
One SPF record with all senders	✅ Pass
Two or more SPF records	❌ SPF error
Missing BrandJet sender	❌ Email flagged

💡 ProTip: Many SPF issues happen because people add new records instead of updating the old one. Keep it all in one SPF record.

How DKIM Signing Protects Your Emails

Credits: Mailtrap 

DKIM works in a different way. It adds a hidden signature to each email. That signature tells the receiving inbox that the email has not been changed.

BrandJet creates the key for you. You place that key in your DNS.

This step builds trust with inbox providers.

DKIM Setup

BrandJet gives you a DKIM record when you connect your domain.

Add this as a TXT record:

• Host: bjet1._domainkey.yourdomain.com
• Value: v=DKIM1; k=rsa; p=MIGf…

Copy both exactly as given.

If even one letter is wrong, the check can fail.

DKIM Failure Comparison

Issue	What Happens
Correct key and selector	✅ Signature passes
Wrong selector	❌ Signature fails
Missing part of key	❌ Email loses trust

DKIM does not stop sending if it breaks. That’s why people miss it. The email goes out, but trust drops.

💡 ProTip: Paste DKIM carefully. Check it twice before saving.

How DMARC Enforces Email Authentication

DMARC is the rule layer. It tells inbox providers what to do if SPF or DKIM fails. It also sends reports so you can see problems.

Without DMARC, failed emails may still go through. That makes it easier for scammers to fake your domain.

DMARC gives you more control.

As noted by Namecheap Knowledge Base

“The DMARC record must be created as a TXT record for the _dmarc subdomain. For cold emailers starting out, a basic record like v=DMARC1; p=none; rua=mailto:dmarcreports@yourdomain.com is recommended to monitor delivery health before moving to a ‘reject’ policy. Ensure that the domain name itself is not included in the Host field, as most DNS managers append it automatically.” – Namecheap Knowledge Base

DMARC Setup

Start with a monitoring record first.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

This record collects reports. It does not block anything yet.

That makes it safer for testing.

DMARC Policy Comparison

Policy	Action
none	Watch only
quarantine	Send to spam
reject	Block email

Each level is stronger than the last.

DMARC Rollout

Move in steps.

• Week 1–2: use p=none
• Week 3+: switch to p=quarantine
• After testing: move to p=reject

Going slow helps you catch mistakes before they affect live campaigns.

💡 ProTip: Do not start with rejection. If your setup is wrong, you can block your own emails.

How Brandjet Simplifies Domain Authentication

Setting up email records can get messy. One tool for SPF. Another for DKIM. Another for DMARC reports. That slows teams down.

BrandJet keeps everything in one place.

Inside BrandJet, you can:

• Generate SPF, DKIM, and DMARC records
• Check your DNS setup
• Track authentication status
• Run outreach across email, LinkedIn, and social channels

This saves time and cuts mistakes.

Instead of switching tools, you work from one dashboard.

Brandjet Vs Traditional Setup

Feature	Brandjet	Typical ESP
SPF/DKIM setup	Built-in	Extra tools needed
DMARC reports	One dashboard	Separate tools
Outreach channels	Email, LinkedIn, social	Email only
Deliverability checks	Live status	Basic reports

Verification And Testing Before Sending

Setup is only half the job. Testing shows if your records are working before a real campaign goes out. A quick check can catch mistakes like missing records, wrong values, or failed signatures.

What you want to see:

• spf=pass
• dkim=pass
• dmarc=pass

Places to check:

• Email headers in Gmail or Outlook
• BrandJet’s deliverability checker
• DNS lookup tools

Testing Flow

Step	Action
1	Send a test email from BrandJet
2	Open the email in Gmail
3	Click “View Original”
4	Check SPF, DKIM, and DMARC results

Common Mistakes That Hurt Email Deliverability

A few small setup mistakes can hurt delivery fast. The email still sends, but inbox providers may flag it, send it to spam, or reject it. That’s why checking your setup in BrandJet before sending matters.

Common Mistakes

• Multiple SPF records → creates an SPF error
• Wrong DKIM selector → signature does not match
• No DMARC record → no rule for failed checks
• Missing return-path match → DMARC can fail
• Sending before DNS updates finish

These checks need to match each other. If one part is off, the whole setup looks less trusted.

Aligned Vs Misaligned

Setup	Result
SPF, DKIM, and DMARC all match	✅ Better inbox placement
One record missing or wrong	❌ Lower trust
Multiple SPF records	❌ SPF error
No DMARC policy	❌ No protection

Real Use Cases From Brandjet Campaigns

Email authentication changes results you can measure. Better setup often means better inbox placement, fewer spam issues, and stronger sender trust. These are common patterns teams see after fixing domain records inside BrandJet.

Cold Outreach Campaign Lift

Teams running cold outreach often see inbox rates improve after fixing SPF and DKIM.

Before Setup	After Setup
More spam placement	Better inbox placement
Lower reply rates	More replies
Weak sender trust	Stronger sender trust

Why it improves:

• Better sender reputation
• Fewer spam flags
• More opens and replies

E-commerce Brand Protection

DMARC helps stop fake emails sent under your domain. Once set to p=reject, fake messages can be blocked before they reach customers.

Before DMARC	After DMARC
Fake emails reach inboxes	Fake emails blocked
More spam complaints	Fewer complaints
Customer trust drops	Trust stays stronger

This is where DMARC stops being a delivery tool and becomes part of email security.

FAQ

How do I fix SPF record errors like SPF PermError?

SPF PermError usually means your SPF record is misconfigured. This often happens when domain owners create multiple DNS TXT records instead of one combined Sender Policy Framework record. 

You need to merge all sending sources into a single SPF record. After updating your DNS records, run a DNS lookup tool and allow time for DNS propagation before testing email delivery again.

Why do DKIM records fail even after correct setup?

DKIM records fail when the DomainKeys Identified Mail configuration does not match exactly. 

Even a small mistake in the public key or selector can break the digital signature. You must ensure your DNS TXT record is correct and complete. Also, confirm your email server uses the correct private key to sign outgoing email messages during the authentication process.

What does DMARC policy actually control in email delivery?

A DMARC policy controls how receiving mail servers handle failed email authentication. It works with SPF Alignment and DKIM under Domain-Based Message Authentication, Reporting, and Conformance. 

You can set rules to monitor, quarantine, or reject messages. This protects against email spoofing and phishing attacks, and improves email security and sender reputation across the email ecosystem.

How long does DNS propagation affect email authentication setup?

DNS propagation affects how quickly your updated DNS records become visible worldwide. Changes to your SPF record, DKIM records, or DMARC policy may take a few minutes or up to 48 hours. During this time, email verification may fail. You should wait for propagation to complete and use a DNS lookup tool to confirm that records are fully updated.

Can poor authentication cause email rejection or spam issues?

Poor email authentication often leads to email rejection or messages being flagged as spam. Without proper Domain Authentication, mail servers may not trust your email sender. 

This increases the risk of email fraud and email impersonation scams. Strong email authentication protocols improve Email Deliverability, protect your brand’s reputation, and help your emails reach the recipient’s inbox consistently.

Getting SPF DKIM DMARC Right In Brandjet

Bad email setup hurts fast. Your emails can land in spam, your domain can lose trust, and your results can drop. SPF, DKIM, and DMARC help prove your emails are real. It sounds technical, but it matters if you want people to see what you send. That’s the hard truth.

The good part is that the fix is simple when you do it right. Set up your records, test them, and make sure everything works before sending more campaigns. If you want a faster way to get it done, start with BrandJet and lock in your email setup before you scale.

References

1. https://www.agentmail.to/docs/knowledge-base/spf-dkim-dmarc 
2. https://www.namecheap.com/support/knowledgebase/article.aspx/317/2237/how-do-i-add-txtspfdkimdmarc-records-for-my-domain/