Deliverability setup

Four things decide whether your email reaches an inbox or a spam folder: SPF, DKIM, DMARC, and where your links point. All four are DNS records on your domain — we cannot set them for you, but here is exactly what to add.

1. SPF — who is allowed to send as you

SPF lists the servers permitted to send mail for your domain. You are sending through your own mailbox provider, so you publish their include and nothing of ours.

You may only have one SPF record. If one already exists, add the include to it instead of publishing a second record — two SPF records is the same as none. Keep the total under ten DNS lookups.

2. DKIM — a signature that proves nothing was altered

DKIM is generated by your mail provider; you only publish the public key they give you.

• Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record → publish the TXT record it shows at google._domainkey → then press Start authentication.
• Microsoft 365: Defender portal → Email & collaboration → Policies → Email authentication → DKIM → select the domain → publish the two CNAMEs (selector1._domainkey, selector2._domainkey) → enable.
• Anything else: ask your provider for the DKIM selector and public key.

DKIM can take a few hours to become active after you publish it.

3. DMARC — what receivers should do when a check fails

Start in monitoring mode, read the reports for a couple of weeks, then tighten.

Once SPF and DKIM both pass consistently, move to p=quarantine and later p=reject. Do not start at p=reject — you will silently kill your own legitimate mail, including invoices and notifications sent by other tools.

4. Tracking domain — required

The open pixel and every rewritten link in your emails must live on a subdomain of your domain, for example track.yourcompany.com. This app will not let you launch a campaign without one.

The reason is blunt: on a shared tracking domain, one careless sender gets the domain blacklisted and everyone using it starts landing in spam — including you, with no way to fix it. On your own subdomain, your reputation is yours alone.

If your DNS provider cannot do a CNAME there, an A record to 49.12.5.27 also works. Once the record resolves, press Check DNS on the tracking page — the HTTPS certificate is then issued automatically within a few minutes.

5. Habits that matter more than any record

• Warm up. Leave the warmup ramp on. Going from zero to 200 emails a day on a fresh mailbox is the single most reliable way to get filtered.
• Keep bounces under 3%. This app checks MX records on import and suppresses hard bounces permanently; if the rate crosses your threshold the campaign pauses itself.
• Make unsubscribing trivial. Every email carries a visible link and the one-click List-Unsubscribe header. Someone who cannot unsubscribe clicks "spam" instead, and complaints hurt far more.
• Don't judge by opens. Apple Mail Privacy Protection pre-fetches images for every message it receives, which manufactures opens that never happened. We flag what we can as automated, but reply rate is the only number worth optimising.
• One person per company. Emailing four people at the same small business reads as spam to them, and they talk to each other.
• Send like a human. Keep the working-hours window and the randomised delay between sends. A hundred identical emails at 03:00 on the dot is a pattern.

Checking your work

• Send an email to check-auth@verifier.port25.com — it replies with the SPF, DKIM and DMARC results.
• Or use the step preview's "send a test to myself", then open the received message and inspect the headers: you want spf=pass, dkim=pass, dmarc=pass.

See also: the Leads API documentation.