What DNS records are needed for email delivery?

A complete email DNS setup requires six key records: MX (mail exchange for receiving), SPF (authorized sender IPs), DKIM (cryptographic message signing), DMARC (authentication policy and reporting), PTR (reverse DNS for IP-to-domain mapping), and BIMI (brand logo display in inboxes).

What is the difference between SPF, DKIM, and DMARC?

SPF declares which IP addresses can send email for your domain. DKIM adds a cryptographic signature to verify messages weren't altered in transit. DMARC ties them together with a policy that tells receivers what to do when SPF or DKIM fails — and sends you reports about authentication results.

Why is PTR (reverse DNS) important for email?

PTR records map a sending IP address back to a domain name. Mailbox providers use reverse DNS lookups to verify that a server's IP matches its claimed identity. A missing or mismatched PTR record can cause emails to be rejected or flagged as suspicious.

What is BIMI and how does it relate to DMARC?

BIMI (Brand Indicators for Message Identification) displays your verified brand logo next to your emails in the inbox. It requires DMARC at enforcement level (p=reject or p=quarantine) as a prerequisite, making it the visual reward for completing your full email authentication setup.

How do DNS records affect email deliverability?

DNS records form the foundation of email deliverability. They prove your identity (SPF, DKIM, PTR), enforce authentication policy (DMARC), ensure you can receive mail and reports (MX), and build visual trust (BIMI). Missing or misconfigured records lead to authentication failures, spam folder placement, or outright rejection by mailbox providers.

DNS Records That Power Your Email

Your email doesn’t just “send.” Behind every delivered message is a foundation of DNS records working together. Miss one, and your deliverability crumbles.

Here’s the complete stack every sender needs to understand:

MX (Mail Exchange)

Tells the world which servers accept email for your domain. Without it, nobody can reply to you — and you can’t receive the DMARC reports that keep your authentication healthy.

SPF (TXT Record)

Declares which IP addresses are authorized to send on your behalf. Your first line of defense against spoofing. Every legitimate sending source — your ESP, transactional service, CRM — must be included.

DKIM (TXT Record)

Publishes your public key so receivers can verify your messages haven’t been tampered with in transit. This cryptographic signature travels with every email you send.

DMARC (TXT Record)

Sets the policy for what happens when SPF or DKIM fails. Report, quarantine, or reject — you decide. At enforcement (p=reject), you’re telling the world that unauthorized messages using your domain should be blocked.

PTR (Reverse DNS)

Maps your sending IP back to your domain. Mailbox providers check this to confirm you are who you claim to be. A missing or mismatched PTR record is one of the fastest ways to get flagged.

BIMI (TXT Record)

Displays your verified brand logo in the inbox. The visual trust layer that rewards a complete authentication setup. Requires DMARC at enforcement to activate — it’s the capstone of the entire stack.

Why Complete DNS Setup Is Non-Negotiable

Each record builds on the others. SPF and DKIM feed into DMARC. DMARC at enforcement unlocks BIMI. PTR validates what SPF declares. MX ensures you can receive the reports DMARC generates.

This isn’t optional configuration — it’s infrastructure. Organizations that treat their DNS as the foundation of email deliverability see fewer authentication failures, higher inbox placement rates, and stronger sender reputation across every mailbox provider.

Treat your DNS like the foundation it is. Every record matters. Every gap is a vulnerability.